§ 

»5b30554cf29073d3ae [Replvl 
Subject: WE ARE PHASE3 

Name: oldfag 

MessagelD: <2a0901 47933761 8@web.oniichan.onion> 
Date: Wed Nov 16 23:06:58 2016 



I declare this to be a throw away bunker. 

IF YOU DETECT SOMETHING FOREIGN ABANDON THREAD 


[hide] 

»5bd3397b509c8a41 35 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <2da981479339022@web.oniichan.onion> 
Date: Wed Nov 16 23:30:22 2016 


THREADS: 

http://s6424n4x4bsmqs27.omon/pol/res/20366.html 

https://web.archive.Org/web/20161030073742/http://8ch.net/pol/res/7946506.html 

https://web.archive.org/web/2016102321 1637/http://oxwugzccvk3dk6tj. onion/pol/res/793 1897.html 

https://web.archive.Org/web/20161024220236/http://8ch.net/pol/res/7962287.html 

https://boards.4chan.org/pol/thread/98716471 

http://oxwugzccvk3dk6tj. onion/pol/res/81 80723. html#q8 192699 

http://oxwugzccvk3dk6ti.omon/tech/res/679042.html 

FILES: 

https://file.wikileaks.org/torrent/2016-l 1-07 WL-Insurance US. aes256. torrent 
https://file.wikileaks.org/torrent/2016-l 1-07 WL-Insurance UK.aes256. torrent 
https://file.wikileaks.org/torrent/2016-l 1-07 WL-Insurance UK.aes256.torrent 
https://file.wikileaks.org/torrent/2016-06-Q3 insurance. aes256. torrent 
https://file.wikileaks.org/torrent/wikileaks-insurance-20120222.tar.bz2.aes.torrent 
https://file.wikileaks.org/torrent/wlinsurance-20130815-A.aes256.torrent 
https://file.wikileaks.org/torrent/wlinsurance-20130815-B.aes256.torrent 
https://file.wikileaks.org/torrent/wlinsurance-20130815-C.aes256.torrent 

https://web.archive.Org/web/20100901162556/https://leakmirror.wikileaks.org/file/straw-glass-and-bottle/insurance.aes256 

BM: 

[chan] wikileaks 


[name] BM-2cVFHKC263sXfXYF7JU3n4FPLY9HD5H7SC 
HASH SHIT: 

US Kerry [1]- 4bb96075acadc3d80b5ac872874c3037a386f4f595fe99e687439aabd0219809 
UK FCO [2]- D3a6de5c627e3270ed3e02f62cd0c857467a780cf6123d2172d80d02a072f74 
EC [3]-eae5c9b064ed649ba468f0800abf8b56ae5cfe355b93blce90alb92a48a9ab72 

sha256sum 2016-1 l-07_WL-Insurance_US.aes256 ab786b76al95cacde2d94506ca512ee950340fl404244312778144f67d4c8002 
sha256sum 2016-1 l-07_WL-Insurance_UK.aes256 655821253135f8eabff54ec62c7f243a27dld0b7037dc210f59267c43279a340 
sha256sum 2016-11 -07_WL-Insurance_EC. aes256 b23 1 Ccef70338a857e48984f0fd73ea920eff70ab6b593548b0adcbd 1423b995 
https://wiki.installgentoo.com/index.php/Wiki Backups 
https://wikileaks.org/wiki/Afghan War Diary, 2004-2010 

FBI ANON: 

https://archive.is/JEXOo 

https://archive.is/pgLpf 

https://archive.is/OnuFe 

http://archive.is/Wt2T0 

https://archive.is/Nct7R 

https://archive.fo/E9YD8 

http://archive.is/0oVo3 

OPENS SL BUG: 

https://github.com/openssl/openssl/blob/master/crypto/evp/evp key.c#L74 

https://web.archive.Org/web/20150921141747/http://security. stackexchange.com/questions/29106/openssl-recover-kev-and-iv-by- 
passphrase/29 1 39 

>The EVP_BytesToKey key derivative algorithm uses md5. It is trivial to break the key for the first block. 

>AES decrypts in blocks 256 bytes at a time, take one of the insurance files, copy the first 256 bytes, make a new tiny file and use the 
key on that, if the data is compressible or has runs on zeros or consant values or has some known values in it, then the key is right 
>https://link. springer.com/chapter/ 10.1 007 %2F 118 14948_1 3 
[code]head -c 256 file > newfile[/code] 

>salts 

[code] strings wlinsurance-20130815-A.aes256 I head -c 16[/code] 

BITCOIN LEADS: 

691dd277dc0e90a462a3d652al 171686de49cfl9067cd33c7df0392833fb986a 

7379ab5047bl43c0b6cfe5d8d79ad240b4b4f8cced55aa26f86dld3d370c0d4c 

d3c 1 cb2cdbf07c25e3c5f5 1 3de5ee3608 1 a7c590e62 1 f 1 f 1 eab62e8d4b50b635 

Cce82f3bde0537f82a55f3b8458cb50d632977f85c81dad3el983a3348638f5c 

2al4783f74796ace53e0a6859a7012723d3d6cd9dacf72d4e90a3394484093df 

657aecafe66d729d2e2f6f325fcc4acb850 1 d8f025 1 2d 1 f5042a36dd lbbd2 Id 1 

05e6c80d9d6469e7dl328e89b9d971bl9972594701586bbcbd70070f2be799db 

623463a2a8a949e0590ffe6b2fd3e4el028b2b99c747e82e899da4485eb0b6be 

5143cf232576ae53e8991ca389334563fl4ea7a7c507a3e081fbef2538c84f6e 


[hide] 

i 

»faa772af9b44a75589 [Reply] 

Subject: None 
Name: OP 

MessagelD: <e1 81 al 47933931 7@web.oniichan.onion> 
Date: Wed Nov 16 23:35:17 2016 


»5bd3397b509c8a4135 

Thanks for posting that for my lazy ass anon. 


[hide] 



& 

»c3c2551 e4de82e1 ca6 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <889f91479339509@changolia> 
Date: Wed Nov 16 23:38:29 2016 


>OP_RETURN data scraped from BTC Blocks around 15th Oct. Planning on doing up until 25th Oct, but power outage and not sure 
where it stopped: 

gateway. glop. me/ipfs/QmXfLkggUEdNvJt4ZKHZLxL4kdil9pWX6G6JVeZ4doodTE/434304 434250ish.txt. gz 
>(H1NT: Bruteforce the insurance fdes!) 

>Script for you to perform this OP_RETURN scrape yourself: 

gateway. glop. me/ipfs/QmaVdcqSowfbr58295ipeZxUU97FmqLXBadBgjcXwuqXa9/block-opreturn-finder.py 

>Change RPC user/pass in code (txindex = 1 must also be set in bitcoin.conf). 

>Use with: 

>python block-opreturn-finder.py blocks 434304 435711 # Oct 15 through Oct 25 


[hide] 

f 

»837547b82abc9b17f6 [Replvl 
Subject: None 
Name: OP 

MessagelD: <6f6281 47933971 1@web.oniichan.onion> 
Date: Wed Nov 1 6 23:41 :51 201 6 


Should I post an onion link that logs bitmessage chans, or should I wait for the real bunker? 


[hide] 

6 

»cf7ef0caf8c1 83f294 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <387421 479340082@changolia> 
Date: Wed Nov 16 23:48:02 2016 


SITE FUCKERY: 

>For one example, go to https://file.wikileaks.org/torrent/ 

>Ctr+F '09-Nov-438498967 06:00', which is not the format the use for dates. 

>Look at the file. You can download a copy of this file from Oct 21 2016 here: 

https://archive.org/details/SaudiArabiaDatabaseFromWikileaks 

>and from June 2015 here: https://archive.is/TdJ4t 

>You can then use the 'diff to compare the files. The output is 'the binaries differ'. 

>That torrent file timestamp was corrupted as back as Jul 25 
http://archive.is/09Gu5 

>podesta 33 started at 53000. podesta 32 ended at 52481. they skipped 518 that are online 52481-52999. duplicates everywhere doing 
empty search gives you less emails than there are online. 

>wikileaks still shows 27515 emails for the dnc but in reality there are 44052 (16537 emails are not indexed) 

TWITTER FUCKERY: 

>video posted with accidental link 
https://twitter.com/wikileaks/status/795706165971841024 


>seems like a random fan girl is running the account 
https://twitter.com/rn cetera 


[hide] 

6 

»75c30e666554ddb025 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <379a61 4793401 72@changolia> 
Date: Wed Nov 16 23:49:32 2016 


»faa772af9b 

we can't post everything that happens in BM because alphabets drop in to give hints and don't want it to be logged 


[hide] 

6 

»d3b38aeb0bea00c7bf [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <8e3b51479340204@web.oniichan.onion> 
Date: Wed Nov 16 23:50:04 2016 


nigguh wut 


[hide] 

§ 

»87f9f5501 6cb9d1 583 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <cc4911479340428@web.oniichan.onion> 
Date: Wed Nov 16 23:53:48 2016 


»75c30e666554ddb025 

But the site already logs it... along with other unrelated bitmessage channels.. 


[hide] 

6 

»34d21 b86e073e6a772 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <03a5d1479340502@chan> 
Date: Wed Nov 16 23:55:02 2016 


oh, there's a bitmessage chan most of you congregated on? 

Either way, I don’t see the point. My only opinion 

>$current_year still using FIoC 


[hide] 



6 

»b35f20b30ce3ce8499 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <59c601479340582@changolia> 
Date: Wed Nov 16 23:56:22 2016 


BLOCKCHAIN ATTACKS: 

>1 know the mempool was flooded a day or two afterwards (40000 transactions as opposed to the usual 4000 or so), but this could've 
been an attack to thwart and discourage adoption of Bitcoin 0.13.1 (SegWit) by those that don't support it. (The timing here is 
suspicious.) 

10/26 

>43000 unconfirmed transactions in the mempool. $10 fees. 

10/28 

https ://ww w.reddit.com/r/Bitcoin/comments/59qiyg/is_there_some_attack_going_whats_with_large/ 

11/7 

https://www.reddit.eom/r/Bitcoin/comments/5bizrb/lblock confirmation fee estimates are absurdly/ 


MANNING STATEMENT: 

https://www.documentcloud.org/documents/3213878-Binder2.html 


[hide] 

»4b2dd88dbbe52e3ad2 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <555491 479340695@chan> 
Date: Wed Nov 16 23:58:15 2016 


»837547b82a 

The point? »5bd3397b50 

>[chan] wikileaks 

>[name] BM-2cVFHKC263sXfXYF7JU3n4FPLY9HD5H7SC 
»75c30e6665 

But BMchans are still public.... 


[hide] 

»626c2f4d3bb89d1 01 1 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <7ff881479340785@changolia> 
Date: Wed Nov 1 6 23:59:45 201 6 


PHONE CALLS: 

https://web. arc hive. org/web/20 16101710151 9/h ttps://bigstorv.ap.org/article/6f997f97c5fl40a29f385ea05flb642c/wikileaks- 

assanges-internet-link-severed-state-actor 

https ://ww w. youtube. com/watch?v=536IK7YhsGw 

https ://ww w. youtube. com/watch?v=A_jhLcvoZqc 


[hide] 



& 

»8d72efc06c9b56f5bd [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <5c4c1 1479340808@chan> 
Date: Thu Nov 1 7 00:00:08 201 6 


Relevant thread on nntpchan »dcb6d2324e 
We solved the internet blackout plan 


[hide] 

i 

»8f0838646a0f2fd72e [Replvl 
Subject: None 
Name: OP 

MessagelD: <666a71479340998@web.oniichan.onion> 
Date: Thu Nov 1 7 00:03:1 8 201 6 


»4b2dd88dbbe52e3ad2 
Alright then... 

Bitmessage logger: http://bm6hsivrmdnxmw2f.omon/chan/general 

Direct link to our bitmessage channel: http://bm6hsivrmdnxmw2f.omon/chan/wikileaks 


[hide] 

»e55c2549b1 85866b1 c [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <1aff51479341204@web.oniichan.onion> 
Date: Thu Nov 1 7 00:06:44 201 6 


NIGGUH, dis no gaym yo 


[hide] 

»3e091 9f52b46741 ad2 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <961 071 479341 383@changolia> 
Date: Thu Nov 1 7 00:09:43 201 6 


DISINFO: 

https://web.archive.Org/web/20100901162556/https://leakmirror.wikileaks.org/file/straw-glass-and-bottle/insurance.aes256 

openssl enc -d -aes-256-cbc -in insurance. aes256 -out onionout -k "ONION" 

openssl enc -d -bf -in insurance. aes256 -out bfonionout -k "ONION" 

openssl enc -d -aes-256-cfb8 -in insurance. aes256 -out fb8onionout -k "ONION" 

openssl enc -d -bf -in insurance. aes256 -out bfrouterout -k "ROUTER" 

openssl enc -d -cast -in insurance. aes256 -out outtor -k "Tor" 


[hide] 



6 

»79fc6c07 1 3c5ab6f34 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <567351479341 676@web.oniichan.onion> 
Date: Thu Nov 1 7 00:1 4:36 201 6 


pre formatted text depends on the server rn 
: AA DDDD 

it will be unified soon (tm) 


[hide] 

6 

»48d6733c449fc74564 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <ef8341 479341 678@changolia> 
Date: Thu Nov 1 7 00:1 4:38 201 6 


»e55c2549bl 

https://wiki.installgentoo.com/index.php/Wiki Backups 

>If the password is ever released ("Whatever happens, even if there's video; it was murder"), the files are encrypted via OpenSSL file 
encryption. 


[hide] 

6 

»0d5f778ca4e0f35d59 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <6bfbc1 479341 735@web.oniichan.onion> 
Date: Thu Nov 1 7 00:1 5:35 201 6 


is this the thread for awesome fast posting? 


[hide] 

6 

»7649469ccc02fea74f [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <fa0e91 479341 944@web.oniichan.onion> 
Date: Thu Nov 1 7 00:1 9:04 201 6 


TRAFFIC FLOW: 

NORMIES -> http://nymag.eom/selectall/2016/l l/wikileak-hashes-dont-match-so-whats-going-on.html?mid=twitter nymag 

PLEBBIT -> https://np.reddit.eom/r/crypto/comments/5czlfz/wikileaks latest insurance files dont match hashes/ 

FULLCHAN -> http://8ch.net/tech/res/679042.html 

ENDCHAN -> http://s6424n4x4bsmqs27.omon/pol/res/20366.html 

BM 

BUNKER (YOU ARE HERE) 



[hide] 

»efd98a043d0550a9b2 [Repivl 
Subject: None 
Name: Anonymous 

MessagelD: <b98b31479342069@web.oniichan.onion> 
Date: Thu Nov 1 7 00:21 :09 201 6 


>using the most well known imageboard on tor as a "bunker" 


[hide] 

»a3ccdb97b654ddb1d8 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <00be81479342595@web.oniichan.onion> 
Date: Thu Nov 1 7 00:29:55 201 6 


»24ecbab5c4 

it's because I am a lazy ass fag muncher 


[hide] 

# 

»e5a83d1 b5bb058f9c6 [Reply] 

Subject: None 
Name: OP 

MessagelD: <fb21f1479342662@web.oniichan.onion> 
Date: Thu Nov 1 7 00:31 :02 201 6 


»efd98a043d0550a9b2 

They wouldn't use the exotic tor only chans I found because of 

>discredit media 


[hide] 

»02f996b4866b728ed0 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <30c0c1479342724@web.oniichan.onion> 
Date: Thu Nov 1 7 00:32:04 201 6 


»e5a83dlb5b 
lol okay 

welcome to the hoard. 


[hide] 



a 

»b25362d6aeec909959 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <3de0f1479342794@web.oniichan.onion> 
Date: Thu Nov 17 00:33:14 2016 


»efd98a043d 

its a temp bunker fambam. waiting for you to find a good one 


[hide] 

»2dba56266c401 67a46 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <c1f1 91 4793431 42@web.oniichan.onion> 
Date: Thu Nov 1 7 00:39:02 201 6 



»e5a83dlb5b 

Couldn't we use one that does not allow images? 


[hide] 

& 

»1 87e50e5b9ee7b1 37a [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <73c01 147934331 2@web.oniichan.onion> 
Date: Thu Nov 1 7 00:41 :52 201 6 


»2dba56266c 
>imageboard with no images 
nigguh, stop smoking dick 


[hide] 

3 

»a82c2e88f2454fea22 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <cdaac1 47934331 8@2hu.tld> 
Date: Thu Nov 1 7 00:41 :58 201 6 


what if i told you the clearnet mirror is up again? 



https://2hu-ch.org/thread-5b30554cf29073d3aeela74c298234c8e36a7bad.html 


[hide] 

6 

»2d631 3586520b31 d32 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <bd1 3e1 479343343@changolia> 
Date: Thu Nov 1 7 00:42:23 201 6 


SHILLS TO DOXX: 

https://www.reddit.com/user/swikil 

https://www.reddit.com/user/cahaseler 

>Yesterday, the "Wikileaks team" did an AMA. The proof was a couple of tweets and a failed attempt at uploading a selfie to imgur. 
The Imgur proof was never updated, and a mod by the name of { mod deleted their accoutn } verified that the image had also been 
emailed to the moderators of /r/IAMA. I created a dialogue with this mod, and they had told me that Wikileaks had never offered a 
PGP signature for proof. The mod has since deleted their entire reddit account. This is a /r/IAMA mod, so basically a reddit employee. 
They didn't just remove their comments... the account is deleted. Please see: 

>https://np.reddit.com/r/LAmA/comments/5c8u91/we_are_the_wikileaks_staff_despite_our_editor/d9vtmhl/?context=3 
https://www.ceddit.eom/r/IAmA/comments/5c8u91/we are the wikileaks staff despite our editor/d9vtmhl/?context=3 
https://twitter.eom/m cetera 


[hide] 

»47f0f7759ad3018de0 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <3c9a41479343436@changolia> 
Date: Thu Nov 1 7 00:43:56 201 6 


this shit aint gonna work without pretty code 


[hide] 

6 

»ef64c0bf28b3f28647 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <67e401479343448@web.oniichan.onion> 
Date: Thu Nov 1 7 00:44:08 201 6 


i think we have/had an overchan.dox 


[hide] 

3 

»461 2f34d060acec88f [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <b68f01479343458@2hu.tld> 
Date: Thu Nov 1 7 00:44:1 8 201 6 


»594840f991 

you're never going to find a better chan than this for this type of activity 



smhtbhfam 


[hide] 

i 

»594840f991 396943b2 [Replvl 
Subject: None 
Name: OP 

MessagelD: <fe9681 479343472@web.oniichan.onion> 
Date: Thu Nov 1 7 00:44:32 201 6 


»2dba56266c40 1 67 a46 

There used to be one on i2p just like that, that would even encouraged this type of discussion. 

Saddly it's down and will never come back But yes most likely we don’t need one that supports images. So if you can find one that 
doesn't make discredit media happen aka has cp/illegal shit in it then yes go for it. 

Remember this is a throw away until we find a better one. 


[hide] 

»aab1 ab7551 5f429375 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <742331 47934371 4@changolia> 
Date: Thu Nov 1 7 00:48:34 201 6 


someone outside NATO should start scraping and decoding the blockchainz with some 20 jiggaflops box and not get v& when they 
find the suppressed leaks 


[hide] 

3 

»86fc28e4354c94896a [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <e2f7a1479343832@2hu.tld> 
Date: Thu Nov 1 7 00:50:32 201 6 


doood the cock chain is forever and always 
it's not going away 


[hide] 

»942db1 97399b97064b [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <b9fe11479344698@web.oniichan.onion> 
Date: Thu Nov 1 7 01 :04:58 201 6 


you're on the undying imageboard, the eternal shitpost sinkhole, the indestructible overchan, 
there isn't anything better than this brah. 



[hide] 

»76f71 05ab5bad0f58a [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <830ed1 479345021 @web.oniichan.onion> 
Date: Thu Nov 17 01:1 0:21 201 6 


spookypasta 

15 Oct: Assange's loses internet access at around 5:00 pm GMT. 

Wikileaks chat goes silent and never comes back: http://wlchatc3pjwpli5r.onion/ 

The embassy tells a caller they can't comment on Assange being alive: 
https://www. youtube. com/watch?v=536IK7YhsGw 
https://www. youtube. com/watch?v=A jhLcvoZqc 

https://web.archive.org/web/2016 10171015 19/https ://bigstory.ap. org/article/6f997f97c5f 140a29f385ea05flb642c/wikileaks -assanges- 
internet-link-severed-state-actor 

At the exact same time this was taking place. Manning had a group of guys try to break her out prison. Read her statement and see 
how the dates and times match: 

https://www.documentcloud.org/documents/3213878-Binder2.html 

18 Oct: file.wikileaks.org/file is made publicly visible. The message ’The Insurance files may have just been released’ is shown for 
about an hour: https://i. imgur.com/6IMYfUK.png 

21 Oct: largest DDoS attack in history takes down Twitter. 

At this point anon notices that the insurance keys were posted on several sites and deleted. People start trying to post the information 
but it is immediately deleted. Everyone takes refuge in onion threads that also disappear. 

22 Oct: Director of Wikileaks dies: https://twitter.com/wikileaks/status/790278989596295170 

24 Oct: Anon is able to find the deleted keys. They are posted and deleted again. 

25 Oct: Someone comes into a thread an gives anon a hint about messages in the blockchain. 

26 Oct: Anon successfully decode their first message in Wikileak's blockchain. Threads are instantly flooded by shills saying that it’s 
not worth looking into and alphabets start giving more tips. The blockchain is blocked with fees and 43000 unconfirmed transactions 
appear in the mempool. 

27 Oct (AM): Anon moves into an onion thread, posts code and a tutorial on decoding messages in the blockchain. Several files and 
messages are found. 

Bitcoin 0.13.1 is released and a 'soft fork' begins: https://bitcoin.org/en/release/vQ. 13.1 

The blockchain is attacked: https://www.reddit.eom/r/Bitcoin/comments/59qiyg/is there some attack going whats with large/ 

27 Oct (PM): Several anon report losing their connection. Talk of v&s and black bagging begins. Someone posts that they discovered 
a flaw that allows anyone to retrieve the password from the files. Clues are dumped and the onion threads go silent. On Tox chat 
someone says someone unlocked some of the files, warns that FBI will announce that new evidence was found in someone's computer 
and that a giant human trafficking operation would be exposed. 

28 Oct (A few hours later): FBI announces they discovered new evidence on Anthony Weiner's computer: 
http://www.nytimes.com/2016/10/29/us/politics/fbi-hillary-clinton-email.html? r=0 

30 Oct: FBI begins posting their own leaks: 

https://twitter.com/FBIRecordsVault7ref src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Eauthor 

31 Oct - 2 Nov: Anon begins analyzing strange code words like 'pizza'. Multiple connections are made. 

3 Nov: Wikileaks confirms the validity of the information found: https://twitter.com/wikileaks/status/794247777756860417 

5 Nov: Manning's statement is released: https://www.documentcloud.org/documents/3213878-Binder2.html 

6 Nov: DDoS attack takes down Wikileaks for the first time in years: https://twitter.com/wikileaks/status/795503927378722816 

7 Nov: Anon notices that several Podesta and DNC emails are missing. 

8 Nov (AM): New insurance files are posted: https ://twitter. com/wikileaks/ status/7 96085225394536448 
8 Nov (PM): Trump wins. 

8 Nov (AM-PM): Farge numbers of cyber attacks target Saudi Arabia and Emirates: https://i.sli.mg/dGc3TG.png 

9 Nov: A single file is changed on the file.wikileaks.org/torrent 

10 Nov: Staff publicly states their concern for Assange's continue silence after the election. Incorrectly states that insurance files are 
future leaks and refers to the ones posted on Nov 8. These are the first files to have filenames that reference their content: 
https://www.reddit.eom/r/IAmA/comments/5c8u91/we are the wikileaks staff despite our editor/ 


[hide] 

f 



»b93661 01 b85d30c4d3 [Replvl 
Subject: None 
Name: OP 

MessagelD: <3fafd1479345502@web.oniichan.onion> 
Date: Thu Nov 17 01 :1 8:22 201 6 


»942dbl97399b97064b 

Well it's sorta good for our cause and bad. 

Once CP gets posted it's really hard to remove because every node as to agree on removing it but at the same time our posts about this 
can never be removed unless once again all the nodes agree on it. 

There is also the fact this decentralized chan has nodes on the clearnet, it's basically a battlefield now. 


[hide] 

6 

»f6cc830c59ba398591 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <fd6c31 479346449@web.oniichan.onion> 
Date: Thu Nov 1 7 01 :34:09 201 6 


people post cp regardless of the law 
thanks obama 


[hide] 

»b3e599b9d3d0d6a9cd [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <90c671479347866@web.oniichan.onion> 
Date: Thu Nov 1 7 01 :57:46 201 6 


DISINFO: 

https://en.wikipedia.org/wiki/The Family %28Australian New Age group%29 


[hide] 

6 

>>90021 c70f5c1 d3af92 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <6d8c21 4793481 84@web.oniichan.onion> 
Date: Thu Nov 1 7 02:03:04 201 6 


DECODE ONE BITCOIN TRANSACTION: 
python jean.py tx_number 

http://gatewav.glop.me/ipfs/OmSU67Ei3TerNe32CcZTgd48iKqsVvBTgeralqBWFiKK9V/iean.py 

DECODE MULTIPLE BITCOIN TRANSACTIONS: 
python jean2.py tx_list.txt 

http://gatewav.glop.me/ipfs/OmafUK8hYKztKD3hNNzF4EsW3N5nUcNvHZ4auEidiLkqJd/iean2.pv 


[hide] 



<s 

»e234a53c7ab35a4add [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <f186d1479348272@web.oniichan.onion> 
Date: Thu Nov 1 7 02:04:32 201 6 


>decide to look at oniichan 
>/pol/ is here too now 

I CANNOT GET MY SAFE SPACE 
EVEN ON THE ONION ROUTER 

To those using i2p, is overchan.oniichan.i2p the correct address? 


[hide] 

6 

»eb3d9a4ba51 384d3b3 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <c5bae1479349534@web. oniichan. onion> 
Date: Thu Nov 1 7 02:25:34 201 6 


»e234a53c7a 

safe from wat? if we dont leak the shit they stopped there wont be an internet for you to be safe in 


[hide] 

i 

»1f42421 c9a5e020923 [Replvl 
Subject: None 
Name: OP 

MessagelD: <f21 741 47934961 3@web. oniichan. onion> 
Date: Thu Nov 1 7 02:26:53 201 6 


»e234a53c7ab35a4add 

Well for starters... We should be staying in this news group... and that random news group post. 

Next it's overchan.oniichan.i2p along with b32 g7c54d4b7yva4ktpbaabqeu2yx6axalh4gevb44afpbwm23xuuya.b32.i2p 


[hide] 

& 

»12e3bd088bd32cc90d [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <14ebe1 4793501 07@web. oniichan. onion> 
Date: Thu Nov 1 7 02:35:07 201 6 




>09-Nov-438498967 06:00 
http://eu.mirrors.as250.net/ 

Thu, 5 Sep 2013 

LIBE Committee Inquiry on Electronic Mass Surveillance of EU Citizens - First Hearing 

SESSION I a€ji Exchange of views with the journalists unveiling the case and having made public the facts 

15:00 - 15:10 a€0 Introductory remarks by Juan Fernando LA“PEZ AGUILAR, Chair of the LIBE Committee 

15:10-16:00 

a€0 Statements by 

o Glenn GREEN WALD, Security and Liberty blog on The Guardian (via videoconference) 
o Jacques FOLLOROU, Le Monde 

o Alan RUSBRIDGER, Editor-in-Chief, The Guardian (the) 

16.00 - 17.00 

a€0 Questions & Answers 

SESSION II 

a€0 Follow-up of the Temporary Committee on the ECHELON Interception System 

17:00 - 17:30 

a€0 Presentations by 

o Carlos COELHO (MEP), former Chair of the Temporary Committee on the ECHELON Interception System 
o Gerhard SCHMID (former MEP and Rapporteur of the ECHELON report 2001) 

o Duncan CAMPBELL, investigative journalist and author of the STOA report "Interception Capabilities 2000" 

17.30-18.00 

a€0 Questions & Answers 

18.00-18.30 

a€ji Concluding remarks and follow-up 

> a€e Follow-up of the Temporary Committee on the ECHELON Interception System 


[hide] 
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»0ee852a1 b7645cfa5a [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <9efb41 4793501 24@ucavviu7wl6azuw7.onion> 
Date: Thu Nov 1 7 02:35:24 201 6 


Are we ready to set public eyes on the blockchain? 

Have an overview document ready for tech-normie distribution. 
Alphabets, if there is any reason not to, now is the time to speak up. 



[hide] 
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»d0fcd2e78538404db1 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <45c021 479350601 @web.oniichan.onion> 
Date: Thu Nov 1 7 02:43:21 201 6 


»0ee852alb7 

alphabets have been pushing us to do this for weeks now 


[hide] 

»3246389ddf48b33e46 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <79c9e1 479351 451 @web.oniichan.onion> 
Date: Thu Nov 1 7 02:57:31 201 6 



>TX 7379ab5047bl43c0b6cfe5d8d79ad240b4b4f8cced55aa26f86dld3d370c0d4c 
>... is significant. 

>file -b 7379ab5047bl43c0b6cfe5d8d79ad240b4b4f8cced55aa26f86dld3d370c0d4c 
>GPG symmetrically encrypted data (CAST5 cipher) 


[hide] 

»cf504945762c54791f [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <9ac541 479351 789@ucavviu7wl6azuw7.onion> 
Date: Thu Nov 1 7 03:03:09 201 6 


The Litecoin blockchain scrape is now ready (blocks 1078900-1089000) 

strings opreturns.txt: 

.3V6 

KH%i 

\<G3c"p&> 

T=R7 

y+y? 

3-H-r 

n57t 

H@W99) 

{0Z& 

C" A U 

hello! 



hello! 

&WJ# 

rCIZz 

i;ki 

$zt"W 

"I_?_ 

8 9R 

)Q*z 

Tq$y- 

hello! 

hello! 

hello! 

hello! 

hello! 

hello! 

hello! 

hello! 

hello! 

hello! 

china 

12345678901234567890 
Yager 's Block App 
Better late than never 
Just do it 

Say hello to eveyone 
Letter is first block app 
uHzl# 

**db 
5U s 
ahBxL 
e"Mh%R 
3?S$ 

012345678901234567890123456789012345678 


The original output file is uploaded here: 

h ttp://gatewav.glop.me/ipfs/Qmal4B5qkrWLBqJDDBqWJkqrAbQN44mlAkhVQE3M3z84H2/opreturns.txt.gz 
shalsum opreturns.txt. gz 

6cfd2ba90a04a6719a6999b4b50707e95b0a8c8b opreturns.txt. gz 

Unfortunately I was a retard and didn't redirect stdout to a file, so I don't have the transaction id's for those, 
ps. I bet this line is the encryption passphrase: 012345678901234567890123456789012345678 


[hide] 

»5cacaf5f0241a3e901 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <a8d4e1479352749@ucavviu7wl6azuw7.onion> 
Date: Thu Nov 1 7 03:1 9:09 201 6 


»cf504945762c5479 1 f 

Contact me please (writer of that script). 

BM-2cTFzqGXPcBaBx2HCHw9xQPq75hwTe7p5Z 


[hide] 
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>>09361 a5bee87bed4df [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <304ab1479353499@web.oniichan.onion> 
Date: Thu Nov 1 7 03:31 :39 201 6 


»cf50494576 

for wish addresses? all? 

the last line is just numbers going up 


[hide] 

»866defd0ea1 0ab8af9 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <76a051479356095@web.oniichan.onion> 
Date: Thu Nov 17 04:14:55 2016 


»cf50494576 

lets run this thing on more boxes. 


[hide] 

>>88831 aea871 35ad2b6 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <c56151479358207@web.oniichan.onion> 
Date: Thu Nov 1 7 04:50:07 201 6 


WE ECHELON NOW? 


[hide] 

»f0ede1 b41 abcd631 53 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <dad441479359288@web.oniichan.onion> 
Date: Thu Nov 1 7 05:08:08 201 6 




Download cryptome.org 

http://archive.is/WfdHA 

http://archive.is/OpRKm 


[hide] 

»9466d72934cfcf8b48 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <6e17a1479359545@web.oniichan.onion> 
Date: Thu Nov 1 7 05:1 2:25 201 6 


https://file.wikileaks.org/file/cms/Psvchosocial%20Medical%20Report%20December%202015.pdf 
>3.2.2. Electronic monitoring through ankle tag 

>Mr. Assange found the wearing of the electronic monitoring device (“manacle”) degrading and 
>described it as the psychological equivalent of being treated like “livestock” and/or being shackled. 

>He experienced chafing and friction from the tag, causing irritation to the skin which reduced his ability 
>to exercise. His movement outside the physical confines of the house was barred from 10 pm to 8 am 


[hide] 

»3e1 e2f7855e680dac4 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <c96b71479380329@ucavviu7wl6azuw7.onion> 
Date: Thu Nov 1 7 1 0:58:49 201 6 


some timeframe pastas 
https://ghostbin.com/paste/zwde6 


[hide] 
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»1 69094f1 3d6c076bdb [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <109661 479381 838@web.oniichan.onion> 
Date: Thu Nov 1 7 1 1 :23:58 201 6 


»fOedelb41abcd63153 

>Cloudcucked 


[hide] 

»e025ec1 ebd6433fb68 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <0cb91 1479392628@ucavviu7wl6azuw7.onion> 
Date: Thu Nov 1 7 14:23:48 201 6 


»5cacaf5f0241a3e901 

Messaged you. I've some problems with the BM client so inform me here if you didn't receive the msg. 

>>09361 a5bee87bed4df 

If you talk about my "ps" line, it was a joke :) 


[hide] 
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»c561 e7d0b1 2fbd6946 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <291 f91 479395890@changolia> 
Date: Thu Nov 1 7 1 5:1 8:1 0 201 6 




[hide] 

»731 cOel a28b01 bc58d [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <e84821 4793961 98@web.oniichan.onion> 
Date: Thu Nov 1 7 1 5:23:1 8 201 6 



Download 



l notbest.jpg 


GETTING TIMESTAMPS FROM THE BLOCKCHAIN: 

gateway. glop. me/ipfs/QmerhXbKc9UmeEtudXNlDA8 IB YEMcCy9wREXKcPEPihcMe/blockchainstamps.txt 
WE NEED STAMPS FOR ALL INSURANCE FILES STAT. DUMP ON THIS THREAD AND BM. 


»656c644f9e94a39334 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <90b781 479401 651 @2hu.tld> 
Date: Thu Nov 1 7 1 6:54:1 1 201 6 


this thread is totally ebin 


»c291 004e2db1 28740f [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <2c6891479401985@web.oniichan.onion> 
Date: Thu Nov 1 7 1 6:59:45 201 6 


[hide] 



[hide] 
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[hide] 
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»6f 1 dc4bb8a1 d36422e [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <c46371 4794021 97@2hu.tld> 
Date: Thu Nov 1 7 1 7:03:1 7 201 6 


DON’T WORRY YOU CAN TRUST THEM. : A ) 


2.ipqDownload 
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[hide] 

»70d02790ac6b75d2b7 [Repivl 
Subject: None 
Name: Anonymous 

MessagelD: <d97151479404293@web.oniichan.onion> 
Date: Thu Nov 1 7 1 7:38:1 3 201 6 


»a06elcc9d5 
51°30'30.7"N 0°07'32.7"W 


[hide] 
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»c9bfe1 d7bde541 3b52 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <9438b1479404524@web.oniichan.onion> 
Date: Thu Nov 1 7 1 7:42:04 201 6 



»70d02790ac 


[hide] 

6 



»82fda8f3b2d9c463dc [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <a2a791479404700@web.oniichan.onion> 
Date: Thu Nov 1 7 1 7:45:00 201 6 


»c9bfeld7bd 
microwave dish connectivity 
hi Julian. 


[hide] 
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»2f2ec9b052c28c1 66d [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <f95771 479405021 @web.oniichan.onion> 
Date: Thu Nov 1 7 1 7:50:21 201 6 


scrub your metadata kids 
this is why 


[hide] 
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»1 d21 bc68c1 6b4bc4b3 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <c2fee1 479405378@web.oniichan.onion> 
Date: Thu Nov 1 7 1 7:56:1 8 201 6 


»2f2ec9b052 

why 


[hide] 
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»2d89781 0a3d13c4c2f [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <7c6d61479405452@web.oniichan.onion> 
Date: Thu Nov 1 7 1 7:57:32 201 6 


»ld21bc68cl 

see 

»c9bfeld7bd 

»70d02790ac 


[hide] 

»ba2e6e89d74ce321a2 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <877ea1479405738@web.oniichan.onion> 



Date: Thu Nov 1 7 1 8:02:1 8 201 6 


»ld21bc68cl 

http://www.nytimes.eom/2016/l 1/17/opinion/why-the-world-needs-wikileaks.html? r=l 


[hide] 

& 

»9257e1 2673C371 6c68 [Repivl 
Subject: None 
Name: Anonymous 

MessagelD: <8400e1 4794091 02@web.oniichan.onion> 
Date: Thu Nov 1 7 1 8:58:22 201 6 


»70d02790ac 
>Provider Uk2net-as 

>Hostname torlandl-this.is.a.tor.exit.server.torland.is 


[hide] 

»d33d6eaba5ed925ede [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <9714b1479409232@web.oniichan.onion> 
Date: Thu Nov 1 7 1 9:00:32 201 6 


»9257el2673 

>IT MUST BE LOCATED IN ICELAND BECAUSE IT USES THEIR TLD 

( A : 


[hide] 
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»833946af2cf93e2c2b [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <a3d791479409558@web.oniichan.onion> 
Date: Thu Nov 1 7 1 9:05:58 201 6 


»9257el2673 

Network AS 1 32 1 3 UK-2 Limited 

organisation: ORG-UL5-RIPE 

org-name: UK-2 Limited 

org-type: LIR 

address: 2nd Floor - The Truman Brewery 91-95 Brick Lane 

address: El 6QL 

address: London 

address: UNITED KINGDOM 

phone: +44 207 053 7676 

fax-no: +44 207 9870424 

e-mail: ripe@uk2group.com 

admin-c: BB963-RIPE 

abuse-c: AR17971-RIPE 

mnt-ref: RIPE-NCC-HM-MNT 

mnt-ref: AS13213-MNT 



mnt-by: RIPE-NCC-HM-MNT 

mnt-by: AS13213-MNT 

created: 2004-04-17T12,23,06Z 

last-modified : 2016-08-1 0T23.06, 1 8Z 

source: RIPE 


[hide] 
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»1 602ef00f572ceddc8 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <a3bed1479409589@web.oniichan.onion> 
Date: Thu Nov 1 7 1 9:06:29 201 6 


»833946af2c 

BUT MUH ICELAND TLD 


[hide] 

»8330450b4641 a9c1 54 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <58c7d1479409649@2hu.tld> 
Date: Thu Nov 1 7 1 9:07:29 201 6 


»833946af2c 


so what does this mean 


[hide] 

»52d1 c2775b87f31 61 2 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <84a871 47940971 5@web.oniichan.onion> 
Date: Thu Nov 1 7 1 9:08:35 201 6 


»8330450b46 

it means you touch yourself 


[hide] 

»7a226fb67a7a77f7b2 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <200b01 479409851 @web.oniichan.onion> 
Date: Thu Nov 1 7 1 9:1 0:51 201 6 


>torlandl-this.is.a.tor.exit.server.torland.is 
>tor exit located london datacenter 
>idiot posts on google via tor 
>freaks out when google shits the bed 



it's the jews 
100% confirmed 


[hide] 
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»f9403f3d08d8feba0a [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <0201e1479409995@web.oniichan.onion> 
Date: Thu Nov 17 19:13:15 2016 


»12e3bd088b 

Looks like this guy did the upload 
https://github.com/stef 


[hide] 
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»b990c067dc1 del 59cb [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <789531479410620@2hu.tld> 
Date: Thu Nov 1 7 1 9:23:40 201 6 


»52dlc2775b 


ok thx gr8 


[hide] 

>>60271 879dda569fd55 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <383681 47941 0832@web.oniichan.onion> 
Date: Thu Nov 1 7 1 9:27:1 2 201 6 


»b990c067dc 

WE HAVE OUR FIRST JEWISH SPY 


[hide] 

»4ef2830c07e1 778a74 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <bf7 1 cl 47941 1993@web.oniichan.onion> 
Date: Thu Nov 1 7 1 9:46:33 201 6 


CAN YOU GUYS LIVESTREAM YOUR VANNINGS LIKE THE TV SHOW COPS. IF YOURE GONNA KILL ALL OUR 
THREADS MIGHT AS WELL ENTERTAIN AND SCARE THE REST OF US. JESUS FUCK. 

WE. 

JUST WANT. 

TO MAKE. 



THE INTERNET GREAT AGAIN. 

>post failed: captcha incorrect 


[hide] 

»9f6d2b03d8d064c487 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <856db1 47941 21 32@web.oniichan.onion> 
Date: Thu Nov 1 7 1 9:48:52 201 6 


MAKE 

INTERNET 

FUN 

AGAIN 


I JUST WANTED TO HAVE FUN BUT THE GOVERNMENT WONT FUCKING LET ME BURN FUCKING EVERYTHING TO 
THE GROUND 


[hide] 

»2d1dd2e1413dc708c2 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <022a71 47941 221 1@changolia> 
Date: Thu Nov 1 7 1 9:50:1 1 201 6 













lol inqtel 

https://wikileaks.org/IMG/pdfAVikiLeaks Response v6.pdf 


[hide] 

»33f77d29fa107eca00 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <8b2401 47941 2544@web.oniichan.onion> 
Date: Thu Nov 1 7 1 9:55:44 201 6 


can someone teach sarah harrison how to computer 


[hide] 

& 

»9490006ab571d327ee [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <9b98f1 47941 3607@web.oniichan.onion> 
Date: Thu Nov 1 7 20:1 3:27 201 6 


»2dldd2el41 

»2dldd2el41 

»2dldd2el41 

>they fell for the palantir meem 
hue 


[hide] 

»cb3a1 05bbddeab1 26e [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <307961 47941 3690@web.oniichan.onion> 
Date: Thu Nov 1 7 20:1 4:50 201 6 


»9490006ab5 

when the cia trusts a company because it can make a nice gui for SQL tables... 
A LITERAL GUI COMPANY 


[hide] 

»bae4d207b252b3bbd5 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <bd231 147941 3786@web.oniichan.onion> 
Date: Thu Nov 1 7 20:1 6:26 201 6 


»cb3al05bbd 

we should get them to make an infographic showing all the hidden leaks in the blockchain 



[hide] 

»270eb038b30e01 Ocfd [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <d39721 47941 421 6@web.oniichan.onion> 
Date: Thu Nov 1 7 20:23:36 201 6 



»2dldd2el41 

This better not end with some rando exposing that Palantir ran were given the Twitter pass for Wikileaks and dropped the ball 


[hide] 

»c64ef244ec61 51 d5cb [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <7232d1 47941 51 65@web.oniichan.onion> 
Date: Thu Nov 1 7 20:39:25 201 6 



»270eb038b3 

>mfw this is what really went down 


[hide] 

»faf57c73b1 e33bf9db [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <a70421 47941 5243@web.oniichan.onion> 
Date: Thu Nov 1 7 20:40:43 201 6 


»cb3al05bbd 

gooey gooey head full of gluey 



[hide] 

6 

»ad8d27861 836a4f6cf [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <21 c071 47941 5551 @changolia> 
Date: Thu Nov 1 7 20:45:51 201 6 


Download 


TIME 

4 ° 


zero.jpg 


»5bd3397b50 

I can picture that OpenSSL bug on the cover of Time with some name like HEART ATTACK. 


[hide] 

6 

»897a3c7ddaa6d55c08 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <6da8c1479415745@web.oniichan.onion> 
Date: Thu Nov 1 7 20:49:05 201 6 


»ad8d278618 

I give it the name leekbreaker 

NO ONE CAN CALL IT ANYTHING ELSE 


[hide] 

& 

»40540abef7f508abdb [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <1 f21 01 47941 5981 @web.oniichan.onion> 
Date: Thu Nov 1 7 20:53:01 201 6 


»897a3c7dda 

if you implement it well push into all blockchainz with that name 



[hide] 

»7c64f2d8dcfbfc51d6 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <3aaa61 47941 61 1 0@web.oniichan.onion> 
Date: Thu Nov 1 7 20:55:1 0 201 6 


>blockchain 

lolno I ain't signing shit niggah 


[hide] 

»b6d009c342fbb95304 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <7aac31 47941 6954@web.oniichan.onion> 
Date: Thu Nov 17 21 :09:14 2016 



»c561e7d0bl 

»c291004e2d 

»a06elcc9d5 

»70d02790ac 

»c9bfeld7bd 

»9257el2673 

»833946af2c 

Could someone sum up what this does/doesn't tell us? 


[hide] 

»78b295ea41 452be1 28 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <fe0261 47941 7068@web.oniichan.onion> 
Date: Thu Nov 17 21:11 :08 201 6 


»b6d009c342 
see »7a226fb67a 
it explains everything 


[hide] 

§ 

»bdd61 976472c5576ab [Replvl 


Subject: None 
Name: Anonymous 

MessagelD: <9a8f7147941 9593@web.oniichan.onion> 
Date: Thu Nov 1 7 21 :53:1 3 201 6 


Where da fuck are you coming from OP? Halfchan? 


[hide] 

»a2990f 1 0b41 72e6aca [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <c95f51479419670@web.oniichan.onion> 
Date: Thu Nov 1 7 21 :54:30 201 6 


>lurking 8chan 
>current fucking year 

wew 


[hide] 

::> 

»245f36f7586a521e53 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <bef7b1 479420527@2hu.tld> 
Date: Thu Nov 1 7 22:08:47 201 6 


»9061 131f315ba93266 
>tox 

lolz 


[hide] 

»9061 1 31 f31 5ba93266 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <49ff81479420529@web.oniichan.onion> 
Date: Thu Nov 1 7 22:08:49 201 6 


»8f0838646a 

we should stop logging the convos. maybe someone make a tox group? 


[hide] 

3 

»047822f7d0a5cc7b62 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <e08cd1479420685@2hu.tld> 
Date: Thu Nov 1 7 22:1 1 :25 201 6 


tox is a literal meme and isn't even close to being anonymous, enjoy jail times. 



[hide] 

6 

»04aefcad81bf53b78d [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <3d8881 479421 220@web.oniichan.onion> 
Date: Thu Nov 1 7 22:20:20 201 6 


»bdd6197647 

»a2990fl0b4 

those places dont even know bout this yet 

»245f36f758 

»047822f7d0 

dis aint gonna work wout fastposting 


[hide] 

3 

»5b01 a2cbdadaeec92c [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <be58a1 479421 245@2hu.tld> 
Date: Thu Nov 1 7 22:20:45 201 6 


»04aefcad81bf53b78d 

FAST POSTING VIA LIVECHAN 


[hide] 
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»8c6ef25bb61 29f0aad [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <95b1 bl 479421 247@2hu.tld> 
Date: Thu Nov 1 7 22:20:47 201 6 


FAST 


[hide] 

3 

»ea968ffec4da0aae83 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <2c4e01 479421 248@2hu.tld> 
Date: Thu Nov 1 7 22:20:48 201 6 


POST 


[hide] 

3 

»dd987f4292ae8336c9 [Replvl 
Subject: None 
Name: Anonymous 




6 


»c68761 eac5932978f0 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <eb4ad1 479421 384@web.oniichan.onion> 
Date: Thu Nov 1 7 22:23:04 201 6 


FAST POSTING REQUIRES JS YO http://oniichanvlo2tsi4.omon/Iivechan/ 


[hide] 
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»65fb33c9691 9fb2dd5 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <37d51 1479421 430@web.oniichan.onion> 
Date: Thu Nov 1 7 22:23:50 201 6 


>tfw livechan is literal shit 


[hide] 

::> 

»a5b2e1 81 a800cc476b [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <36a1 41479421 453@2hu.tld> 
Date: Thu Nov 1 7 22:24:1 3 201 6 


stop being a literal jew 


[hide] 

»fb0a26fad96a8fec1 0 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <cd3aa1 479421 458@web.oniichan.onion> 
Date: Thu Nov 1 7 22:24:1 8 201 6 


»5b0 1 a2cbdadaeec92c 
»8c6ef25bb6 1 29fOaad 
»ea968ffec4daOaae83 
»dd987f4292ae8336c9 
»c68761eac5932978fO 

if you fastpost the livechan the thread stays bumped and the intel slid 


[hide] 



3 

»d0f299d2e36361 1 ade [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <f9d5c1 479421 474@2hu.tld> 
Date: Thu Nov 1 7 22:24:34 201 6 


»fb0a26fad96a8fec 1 0 

STOP BEING A SHILL NIGGUH 


[hide] 

3 

»e3b6779c582bac4bc4 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <5a8af1 479421 591 @2hu.tld> 
Date: Thu Nov 1 7 22:26:31 201 6 


also on fucking clearnet at https://2hu-ch.org/livechan/ LOR THE NORMALLAGS THAT CAN'T LUCKING USE GOOD 
INTERNET 


[hide] 

(S 

»1ad088baea9abc623e [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <7bdc21479422840@web.oniichan.onion> 
Date: Thu Nov 1 7 22:47:20 201 6 



http:// gateway, glop. me/ipfs/OmY7Uv6PMslvfKyrxTONn6win97gaaqS4aEodlZtDsAkAP/CxfsS4UUAAAUXBp.ipg:large. jpeg 
https://twitter.com/Mangazos/status/7993673520601006Q8 


[hide] 

»5ba8fabb2cea73951 a [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <58bb51479423023@web.oniichan.onion> 
Date: Thu Nov 1 7 22:50:23 201 6 


» 1 ad088baea9abc623e 



FUCKING FAKE 


[hide] 
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»9c921 8fae4cc41 bd8b [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <32e431 479432695@web.oniichan.onion> 
Date: Fri Nov 18 01 :31 :35 2016 


live larp https://8ch.net/pol/res/8281601.html 


[hide] 
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»746d931 1 ae4a2f9a73 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <79375147943281 6@web.oniichan.onion> 
Date: Fri Nov 1 8 01 :33:36 201 6 


-—BEGIN RSA PRIVATE KEY— 

MIIBywIBAAIhALTkEtJNks0p+TGfS821ArlHzyjY/SC5G3TJbYrTMmllUaqnfPUB 

k2j 1 zhxAhxFeal J89X/vfQXbf8 1 8 A3ntZPl AhKFmNWUIOfqCRHUFqEFi YV05c 1 Du 

ZL/RuQwf6fsRZQIDAQABAmApZupH6Clpe+nlSah39K4jlI09vaxyC0wXluKTm7M2 

H/wJKzyWdz3eECSUotBHUWxxieN93GZJbRmneIH3UuGK06/JRe5YTrx4rmEotJ6k 

Xpnke2EnOOGvq/5Tk2MjogECMQDqDKesoH/RRREfuh5VnYLnvtNQbgJoJbdWRHHv 

kqeWadeoSG+Y34dl9vWZtAmM5zUCMQDF2x+uckfKK5xW4qN44UbCIc/QqsqR5RIM 

xwHHBexxrISzrhXVVmRoEWk0rdgeV3ECMQDlzZ8k5EIb29DAciIutgU+PiOFqT47 

vCyTS4kDTd+21B2nYdgRJgj/Tog/boKiErECMEpr2KfaToyKCNlZlFmkiuP8qdl4 

VIe6HSb3OADvhndfh+65/XZob44BdowdE9yd0QIxAKLKG7RbKPG7dq05gSeWe4Ej 

XMItJa9Et4LMeZY6w8J345JFZzwKP8w4vSjLfHGm4g== 

END RSA PRIVATE KEY— 


[hide] 

6 

»80e1 ce41 31 de793692 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <9e3531479433473@web.oniichan.onion> 
Date: Fri Nov 1 8 01 :44:33 201 6 


R29vZ2xlIGlzIG5vIGlvcmUuIE5vdyBhbmQgZm9yZXZlciBvd251ZCBieSBBbHBoYWIldCAoQ01BLCBOU0EsIEZCSSk= 


[hide] 

»f506495202b86e94e3 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <400db1479435277@web.oniichan.onion> 
Date: Fri Nov 18 02:14:37 2016 



»9c9218fae4 

ive never seen mods this spooked 


[hide] 

6 

»3eaeb0034cbf26661 7 [Repivl 
Subject: None 
Name: Anonymous 

MessagelD: <66337147943651 6@web.oniichan.onion> 
Date: Fri Nov 18 02:35:16 2016 


»f506495202 
>8chan isn't compromised 


[hide] 
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»8e6b4805cfe01 a79a0 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <533021 479454001 @ucavviu7wl6azuw7.onion> 
Date: Fri Nov 18 07:26:41 2016 


STORY REMOVED FROM /R/FICTION ALMOST IMMEDIATELY 

(This is purely a work of fiction. Any resemblance to real persons or events are purely coincidental.) 

"If the password is ever released ("Whatever happens, even if there's video; it was murder"), the files are encrypted via OpenSSL file 
encryption. " 

The Great Wizard of Leaks had been exposing the corruption of the Kings and Rulers for a long time. But one day after exposing their 
treasonous actions in foreign lands, they decided that he had gone too far. As a result. The Great Wizard was forced to take refuge in a 
castle that the Kings and Rulers did not control. The Great Wizard resided here for five years and continued to cast spells that upset 
the people's tyrannic rulers. 

However, on October 15th in the Current Year, the Rulers had had enough and decided to unplug the source of the Great Wizard's 
power (the Internet), thereby preventing him from interfering with their rigged election which favored the Great Witch of the West 
(aka: The Cunt). Despite this. The Cunt still lost to the Almighty Knight Sir Trumpador Maximus Decimus Meridius III, who claimed 
he had plans to bring peace to the Lands and "drain the swamp" that gave The Cunt and her cronies their power. Although sensible 
people were not all trusting of Trumpador, most of them realized that he still represented their best hope. 

Things started looking better in the West, but there were still some problems. 

Well known and generally despised Gargoyle $oros was trying to sow seeds of division amongst the people in order to regain control. 
He had managed to split the people of the land broadly into two opposing groups. The Left and The Right, exploiting their fears by 
exaggerating everything unkosher that Knight Sir Trumpador Maximus Decimus Meridius III had said. The Gargoyle even went so far 
as to fund civil rebellions, using the same techniques of subversion that were used in other lands to the East to overthrow 
Governments that the Gargoyle did not like. "Divide and conquer!" he had told The Cunt and her cronies. "It is far easier to conquer a 
land if the citizens are divided and cannot put up a unified resistance!" 

Meanwhile, The Great Wizard may have had his own woes. Since his source of mana (Internet) was cut, the people had not heard 
from him and his group of apprentice wizards (belonging to a noble order known as WizardLeaks). They had become seemingly 
incommunicado. Rumor has it that their order was infiltrated by treasonous goons working on behalf of The Cunt and the Gargoyle 
and it was entirely possible that the Great Wizard himself had been captured. 



The King and his Alphabet Stooges may have been clever here though. Instead of letting the people know that the Great Wizard had 
been illegally abducted, they may have chopped previously unreleased interview footage to make it appear as though the Great Wizard 
was still alive and well. This is not confirmed, but the people have good reason to speculate. 

The Great Wizard always knew that his capture was a possibility and thus dispersed gold to the people which could only be unlocked 
with a key that would automatically release if his Wizardly Magic was to cease. 

On October 22nd in the Current Year, this may have occurred. The well-established MagiRealm known as Readit and the sensitive 
town of Twithurt were attacked and brought down while the keys were allegedly getting dispersed. Most mentions of the alleged keys 
on Readit and Twithurt were also removed. 

Some citizens that frequented the horrible lair known as Forchan, believed to be the dwelling place of the notorious hacker known as 
Forchan, also reported that The King's Alphabet Stooges were even removing the alleged keys from there. 

They started wondering where else The Great Wizard may have hidden the keys to this gold. A place where the Alphabet Stooges 
would have a hard time removing it. 

After much thought, some citizens agreed that the most likely place was in a thing called the "Blockchain" that resided in the 
MagiRealm. This would be hard to for the Evil Alphabet Wizard's to censor as it is mostly controlled and determined by the people 
themselves. 

The question is: Are you a bad enough dude to help rescue The Great Wizard? 

A completely fictional timeline of events follows below. 

IPFS Link: 

http://gatewav.ipfs.io/ipfs/QmWoDedTC5rmxpUsgap7GCfXcrqZfaHV9ZBTegRSMLNraG 


[hide] 

::> 

»0badf0a71 aebdl 2ec8 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <92a7f1479457262@2hu.tld> 
Date: Fri Nov 1 8 08:21 :02 201 6 


»731c0ela28 

This Insurance files timestamp proofs in bitcoin blockchain still aren't rechecked and confirmed. 

I am too stupid to understand how it works but some of higher wizards should make some post showing how it works and where file 
hashes appear in blockchain. 

https://www.ceddit.eom/r/WikiLeaks/comments/5dd5tw/insurance files timestamp proofs using bitcoin/ 


[hide] 

i 

»5dadeaca8d536b523f [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <c1 1d31479457980@chan> 
Date: Fri Nov 18 08:33:00 2016 




»8e6b4805cfe01a79a0 

What does this make us, the ebin wizards of shitposts, great wraiths of darkness or dramatica warlocks of exposing? 

>here comes the larpers 


>Spell checker shitposts: Shintoists 
>This dam spell checker 


[hide] 

& 

»b271 44cf2f968803cd [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <580ac1479465333@ucavviu7wl6azuw7.onion> 
Date: Fri Nov 18 10:35:33 2016 


Anyone else unable to use BM anymore? 

Any solutions? Assume (((they're))) flooding with fake nodes. 


[hide] 
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»522af7aea69e38edcb [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <af1 1c1479465603@web.oniichan.onion> 
Date: Fri Nov 18 10:40:03 2016 


»b27144cf2f 
Solution = dont use bm 


[hide] 

»2f484b089d1723485e [Replvl 
Subject: None 
Name: Anonymous 



MessagelD: <37c771479466067@ucavviu7wl6azuw7.onion> 
Date: Fri Nov 18 10:47:47 2016 


»b27144cf2f968803cd 

Why don't you use ire on i2p? Just create a channel nigger. It's not like it's going down easily. 

TUTORIAL FOR MENTALLY CHALLENGED 
have i2p router going? 

>open ire client, connect to 127.0.0.1/6668. Connection goes you > i2p 
have tor connection? 

>open ire client, connect to ogn5vbujhrvbihko.onion/6667. Connection goes you > tor > i2p. Its slow af though. 


[hide] 

»71 1 3266fde9bb5782c [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <12d8f1 479466961 @ucavviu7wl6azuw7.onion> 
Date: Fri Nov 18 11:02:41 2016 


»522af7aea69e38edcb 
Thanks for your helpful tip CIA. 

There are some good people within your ranks subverting from within. I hope they eventually make your name and address public. 
»b27144cf2f968803cd 

Out of naivety, I do not feel that secure using it. 


[hide] 

»9e2581f80dfc9f9943 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <425781 479509609@web.oniichan.onion> 
Date: Fri Nov 18 22:53:29 2016 



Download image. png 


[hide] 

& 

»afa3e79c3bae1c784e [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <fe1 891 47951 3634@web.oniichan.onion> 
Date: Sat Nov 19 00:00:34 2016 


overchan.he. fell. for. the. wikileaks.meme when? 



[hide] 

§ 

»eaf8bd56f0392e8bf3 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <0ca1 a147951 5940@chan> 
Date: Sat Nov 19 00:39:00 2016 


5-jp g 

»afa3e79c3baelc784e 

When they start to understand how bad wikileaks fucked up OPsec and how wikileaks only had a hidden service up for like four 
months, I think, it was for the main site. 

Which is highly fishy on it's own 

>ideas over identities meme 


[hide] 

»61c43bec87f9fb9bff [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <31 73e1 47951 8224@web.oniichan.onion> 
Date: Sat Nov 1 9 01 :1 7:04 201 6 


He guys. We need to start talking through the blockchain immediately to make sure that everything is permanent. 

There are version of the OpenSSL/EVP exploit that are being deleted everywhere (or threads flooded with cp). We need to encoded 
into BTC and Litecoin blockchains stat. 

People are begging to find the suppressed emails: 

https://www.reddit.eom/r/DNCleaks/comments/5clikn/work in progress wikileaks the missinglosthidden/ 

Remember that Wikileaks never had duplicates in the past and they are now being used to get the number of leaked emails falsely up. 
This can easily be tested. 

Also, users are not reading certain emails because they think it is SPAM. This is incorrect. They embedded their communications into 
emails that look like SPAM to that users never read them. Don't fall for this. 

This strategy was used on this thread: http://8ch.net/pokres/828 1601 .html There is SPAM larper used to hide real information. The 
larper says 15 staff and immediately makes other users not read further. Pay attention to the thread and you will see that a user with a 
Tor ID is posting provable facts that lead to unlocking the files and finding the suppressed leaks. 

I will post more information again soon. One important thing is to push a list of provable testable facts and code into the blockchain. 
We won't be able to spread it without this. 





[hide] 
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»9927e7ea99ac595d15 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <853251 47953401 4@web.oniichan.onion> 
Date: Sat Nov 19 05:40:14 2016 


»61c43bec87 

Fake wikileaks confirmed to be reading our shit. 
https://twitter.com/wikileaks/status/799829999314468864 


[hide] 
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»ba949527cf4a50040b [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <af5341479550729@2hu.tld> 
Date: Sat Nov 19 10:18:49 2016 





Download 


fakePGPsianinadate.ipg 


>we want PGP signed message as proof of life 


tl;dr Many people are asking for PGP signed message as proof of Assanges life. 

We DON'T have knowledge of any PGP key that is owned strictly by Assange. 

I havent found any sources of PGP key that would be used exclusively by Assange, (just one from some mailing list from 1996, 
probably not used anymore) 

We have two keys that might be owned by WikiLeaks: Editorial Office Key and High Security Signing Key(this one might be fake, 
there is no proof of WL or Assange ever owning it). 

You can check keys on distributed PGP key servers. This is one of them: https://pgp.mit.edu 

1. 0x92318DBA 2015-04-10 WikiLeaks Editorial Office High Security Communication Key (You can contact WikiLeaks at h 
ttps://wlchatc3piwpli5r.onion and h ttps ://wikileaks .org/talk) <contact-us-using-our-chat-system@wikileaks.org> 

This one is controlled by Editorial Office. PGP message signed by it doesnt mean Assange signed it. It might even been compromised 
if servers and assets were taken over. 

This key matches h ttps://wikileaks.org/#submit wlkey (that is only public proof that this key is owned by WikiLeaks. Or current 
admin of wikileaks.org) 

2. 0x73C81ElB 2015-04-10 WikiLeaks High Security Signing Key (The key is available to view at h ttps://wikileaks.org/wl-high- 
security-signing-key . You can contact WikiLeaks at h ttps://wlchatc3piwpli5r.onion and h ttps://wikileaks. org/talk .) <contact-us- 
using-our-chatsystem@wikileaks.org> 

For this one we have no proof it was ever used by Assange or WL. I havent found any mention of it on internet. Its also not signed WL 
Editorial Office key, so they havent show they trust it. 



On link https://pgp.mit.edu/pks/lookup?op=vindex&search=0x93ED732E92318DBA you can see I managed to sign 0x923 18DB A 
WikiLeaks Editorial Office with fake key I created. (239D778D 2015-04-10 Fake Wikileaks key for testing fake creation time 
(Created in Oct 19 2016) <Fake@fake.com>) 

My key is even higher than "WikiLeaks High Security Signing Key". 

If I would use same credentials as WikiLeaks High Security Signing Key, there would be no way to tell which key is more "High 
Security". Only difference would be in fingerprint. But because https://wikileaks.org/wl-high-securitv-signing-key is 404, there is no 
way to tell which fingerprint is legit. I would be able to sign any message and majority would believe that it was signed by Assange 
himself. Not even WikiLeaks twitter would be able to disprove me since my key, judging by the name, appears higher authority than 
Editorial Office Key. I could even make it look older. 


[hide] 

»999fdfd322e1942a78 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <8fb1 51 47955291 9@ucavviu7wl6azuw7.onion> 
Date: Sat Nov 19 10:55:19 2016 


»ba949527cf4a50040b 
>inb4 not your personal blog 
>tldr 

We can't confirm A being alive with PGP. 


[hide] 
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»8c52ab606f70e681 ee [Replvl 
Subject: None 
Name: Not guccifer, srs 
MessagelD: <31 1 bel 479579240@chan> 
Date: Sat Nov 19 18:14:00 2016 



PI 
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1 1-1 9T1 1-09-26Z.htm public key on website as of 2016-11- 


1 9T1 1 -09-26Z.txtDownload new banner. png 

Anyone like their new BANner? 

»9927e7ea99 

Whomever LARP’ed that day, whether intentional or not, managed to stir @m_cetera, who is controlling @wikileaks to post this. If 
that was their intent, they succeeded. So kudos, we have now double confirmation 1 person is managing the twitter account, and the 
team is dead. 

»ba949527cf 

However, there’s only one private key that should match PGP: A04C 5E09 ED02 B328 03EB 6116 93ED 732E 9231 8DBA IFF it 
gets changed. When that day happens, beyond a shadow of a doubt wikileaks has been compromised. 

Btw, this should have been done since the beginning. Attach "yours" if you want. 

The point of this exercise is not to discredit wikileaks since it’s been compromised, but to show blind trust cannot be yielded to 
everyone. I’ve stressed this time and time again, but leaks can be self -published, e.g. GUCCIFER 2.0. They don’t need anyone's 
approval or appraisal. 


[hide] 

»3d765925998ef1 0896 [Repivl 
Subject: None 
Name: Anonymous 

MessagelD: <e26c71 479581 574@web.oniichan.onion> 
Date: Sat Nov 19 18:52:54 2016 


what if we made an overchan.leaks board ? 
overchan.blow.me ? 


[hide] 

6 

»cefa3408ec75c9de93 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <66b461 479581 977@web.oniichan.onion> 
Date: Sat Nov 19 18:59:37 2016 


»>/overchan.blow.me/ 



[hide] 

»7fcc54e0cda86f79fb [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <2d9751479583426@web.oniichan.onion> 
Date: Sat Nov 19 19:23:46 2016 


REALTALK: 

This shit sucks and only seems to make sense in the same sort of way dig threads do today (thinking 8/v/ et al.) 

It will never yield results, never be much better than the shittiest thread, and most of all will only cater to the most narrow of leads. I 
just don't see this developing into anything simply because of how imageboards have changed as a medium and how this site doesn't 
fit the real niche. 

Consider me a sceptic but I've been watching this for months and if it's this or blow my brains out I'll be grabbing the gun. 


[hide] 

6 

»dce88483b60e4dd095 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <02179147958501 1@chan> 
Date: Sat Nov 19 19:50:11 2016 


»8c52ab606f 

they differ wikileaks is dead. 


[hide] 

6 

»3f61 0429a0f1 486425 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <ec4821479593736@web.oniichan.onion> 
Date: Sat Nov 19 22:15:36 2016 


»7fcc54e0cd 

There are already plenty of results. Some of the stuff here has ended up on the news, the front page of plebbit and now on two tweets 
by the Wikileaks impostors. 

There is a lot more findings that get deleted. We are working on a way to embed a thread into the blockchain to be able to post them 
permanently. 


[hide] 

(S 

»a320b37cfe44bc30e9 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <0dad51479593765@web.oniichan.onion> 



Date: Sat Nov 19 22:16:05 2016 


»dce88483b6 
differ how? 


[hide] 

: 2 > 

»6cc6be37485ce202f2 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <419931479594242@2hu.tld> 
Date: Sat Nov 19 22:24:02 2016 



1 41 48254f340a56f71 e524467ad92f2720388b47299731 be95f3ba203690dd44. 


ififl 


they differ because he posted 3 different keys 
you have to look only at fingerprint I 


Here are three posted keys: 

https://pgp.mit.edu/pks/lookup?op=vindex&search=0x6C02EB218229E48B 

https://pgp.mit.edu/pks/lookup?op=vindex&search=0x93ED732E92318DBA 

https://pgp.mit.edu/pks/lookup?op=vindex&search=0x71862823239D778D 

Note that you can have same key and would not look the same (bottom of it), because one on server can be signed by more keys than 
one on wikileaks.org 


[hide] 

»289c5e7e2e63ba4a65 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <700b21 4795981 98@2hu.tld> 
Date: Sat Nov 19 23:29:58 2016 



-—BEGIN PGP SIGNED MESSAGE 
Hash: SHA256 


Dear Bunker, 



It's us. Wizards of Leaks, once again. Except this time it's the The Great Wizard of Leaks speaking. 

We are finished with your child shilling, LARPing, and cruel jokes that spread like a snakes bite and ruin the internet. Where have all 
of the internet's problems come from? CIA? NSA? No, no. 

Here. 

Tonight at 12:00am Bunker will officially come to an end. 

"kek u cant do sh*t" 

Not only do I have my hacking skills and team aside me, but I also have FBI, the founding website of Wizards of Leaks, aside us. 
You're probably all thinking 
"DARNIT GUYS WHAT DO WE DO" 

There is one thing you CAN do. Surrender. I want Moot and Outer Heaven here, with the ID and everything, saying sorry, and 
deleting all of things disgusting things from your nodes. 

As of now, you have 4 hour and 04 minutes. 

The clock is ticking, gentlemen. 

We are Wizards of Leaks. 

We do not forgive. 

We do not forget. 

- - Julian 

-—BEGIN PGP SIGNATURE— 

Version: GnuPG 100K IN 1810CKCH41N 

iQIcBAEBCAAGBQJYMN8BAAoJEHGGKCMjnXeNORsQAJBDs09B15uQ0zmUNReq2OdP 

FlDYPt6hAbpDrR4E3UP4PQkSCKnLSRNbC4dXfzTkclk3pNiJAth8c5yAu71p7j79 

T//z+AFlQA7Es/ucMsplv9VktBxL2JTNlxWFEn+bf2EHSYMRpsyqIhsFxrny6vRN 

UBZ0Z6GqCRlyqheWH7VueAN5p9hHHf/t8mwoYJETQNGxTsqK4CVr0sFK/ekMcrRA 

uOa5dAo/uE+rLeFULqYSpFrNigrjWi+msBCypDsQRQjhVeZL2rQQPiK7xSWK4Mi6 

986/6mZrRhAs2AZ41exGHj09WnTQBomXSjRjyClblc3Uhxkw/MEN2nFlKyqtPMy3 

/x04y9asX2GqmgIGqwxipwfMIOaLIooMjOU9FqfHAY3X77EcWoRlahobKKKutckH 

y3hoKci+yNVlbJPcUT20IvigQeA/4nIyCwrwai9h+FlVoZtsTz+4WFPlNbTadne/ 

ewzjJWgShmkAnIkR8osDzfd5DkOEJ6xH6n6ffBUsUPClGgs8Gwc5/vDjl68LYbFB 

xR8T wiy twqlG J V/z 1 z00hjn6TFNRs/auG vHh2y YsQ 1 lLUvuv V wDmA861L48edaya 

M3nk/aewmbtguNMVD AfhMJ wMuC YhOP59mKXggQz VqP9X3 Aj9mleM+Zw 1 7xplCnD/ 

4a9eapHkanznCETY zGwp 
=sxma 

END PGP SIGNATURE— 


[hide] 

»624c885c9abc9692ea [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <d5bd01479598662@web.oniichan.onion> 
Date: Sat Nov 19 23:37:42 2016 


»289c5e7e2e 

0/10 

julian has a beard 

post a real timestamp with "wikilkeaks did 9/11" on it or it's not real lol 



[hide] 

6 

»1 07a28552971 0e38c2 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <3910c1479600749@web.oniichan.onion> 
Date: Sun Nov 20 00:1 2:29 201 6 


https://np.reddit.com/rAVikiLeaks/comments/5dtl6v/wikileaks made some interesting transactions/ 


[hide] 

»c928465dee65f057ee [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <239891 479601 537@web.oniichan.onion> 
Date: Sun Nov 20 00:25:37 201 6 


»107a285529 
jewish conspiracy 


[hide] 

::> 

»223057b484e9b23c32 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <76241 1479602948@2hu.tld> 
Date: Sun Nov 20 00:49:08 201 6 



[hide] 

6 

»4af8f6345765d1d34e [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <c4fb31 479603956@web.oniichan.onion> 
Date: Sun Nov 20 01 :05:56 201 6 


»223057b484 


nice shoppe 




[hide] 

»566a96387c731cf4fe [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <b48501479605225@2hu.tld> 
Date: Sun Nov 20 01 :27:05 201 6 



have to go feed @embassycat 


keep fighting 


[hide] 

»1 053e63e2d35892dc7 fReolvl 
Subject: None 
Name: Anonymous 

MessagelD: <a41e71479612532@web.oniichan.onion> 
Date: Sun Nov 20 03:28:52 201 6 


THREADS WITH DELETED KEYS: 
https://8ch.net/pol/res/7931897.html 

https://web.archive.org/web/2016102321 1637/http://8ch.net/pol/res/793 1897.html 
https://8ch.net/pol/res/793303 1 .html 

https://web.archive.Org/web/20161022203236/http://8ch.net/pol/res/7933031.html 

https://8ch.net/pol/res/7962287.html 

https://web.archive.Org/web/20161029143658/http://8ch.net/pol/res/7962287.html 

https://8ch.net/pol/res/7946506.html 

https://web.archive.Org/web/20161030073742/http://8ch.net/pol/res/7946506.html 

https://web.archive.Org/web/https://boards.4chan.org/pol/thread/93319969 

https://web.archive.Org/web/20161019170505/http://8ch.net/pol/res/7881571.html 

https://archive.fo/K2oGX 

https://archive.fo/jBS6q 

https://archive.fo/vrl6Q 

https://archive.fo/koTtO 


[hide] 

6 

»fe5c4ffa76090ff71 1 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <bd7dd1 47961 521 9@web.oniichan.onion> 
Date: Sun Nov 20 04:1 3:39 201 6 



MISSING EMAILS WORK IN PROGRESS: 

https://www.reddit.eom/r/DNCleaks/comments/5clikp/work in progress wikileaks the missinglosthidden/ 


[hide] 

»37076ffb32749acb69 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <9b15e1479631348@web.oniichan.onion> 
Date: Sun Nov 20 08:42:28 201 6 


-—BEGIN PGP PUBLIC KEY BLOCK— 

Version: SKS 1.1.5 

Comment: Hostname: pgp.mit.edu 

mQENAj Y nbooAAAEIALrE V06TI49DU StofY g/cTnN/XcnGIBrO+lWJ 1 dCCI5aY tCu+S9 Y trdJ 

SBdiEkFM4fKJippivvpgPolSOcDwQH6slQthPAJllWpISE69xf7MvbVODFf5wAKJxS/9Tiz3 

gynUSpWTE10n0R8zepgkNxhU9J9MVQ/UahwL3BLGxlDHGfnX9HvnNBRpj4ALcRG+I6CwMcl 

Iq25hOvG+k2dK6002oTrCoYCyC/IzpnUuBQB6nhrls83r3R3Z+eortbMki40WP+X2ydwPKav 

9JiAxV4HEAUjF8pMW2khbJSZKjCPTjDAQNY6hvyDwso5NJGhGxj7aOWjWqOySCjgAgL4YcEA 

BRG0IkplbGlhbiBBc3NhbmdlIDxwcm9mZkBpcS5vcmc+IDIwNDiJARUCBRA2J26KSCjgAgL4 

YcEBAfLyB/9hxniilfYhJDEW4LK+dr40pJ3chp8eiVd6nxGTD8Vslar7Y99Y3vUKMc65giWN 

xFBEmOEPIslacxch8mK91qjTiIqCSIWDX7us0ZoCzXqqWhvSilUdAa05XnlIreYfids0DJSl 

AeWsmxreZrNG2J/ibGdgFcT183pS6EhlBB0gjlBR6vnS3PEokJERplwVYuKTONaCmmneex2B 

YRV0VTuyoBGe9OlAQhreHLaW8X8GyxZ6+WzErqK3meruKT71fDCIULMR4DAYxtZYiwTT65zw 

qQYX3N75WeJgUYhiEXl/JzisripGKzK6jLyVqtzayrxm0QpmTTcjjqzO2wVgMp8tiJwEEAEB 

AAYFAjZGKG4ACgkQolKYYFEYdpG8/wP/UfbmnNKhQJLma7puaLrT6ISjVuhWbSnUOW6PHs63 

fbIim2zNjjOpbIFf8X4a7evVarUhRMO3OtPxmjiUcZ6DBqbQiewHHejc36mWz0HGvJP9h4Re 

xYAsbpfRbUJiaf61cSbbJCdliLHxgdrK6wLVEtJ0IN9Fpm/r0/hv9Ah50Jg= 

=wKtX 

END PGP PUBLIC KEY BLOCK— 


[hide] 

& 

»eb62b1 00a5bd705b20 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <3bafb1 479631 465@web.oniichan.onion> 
Date: Sun Nov 20 08:44:25 201 6 


C CODE TO READ LOCAL BLOCKCHAIN: 

http:// gateway, glop. me/ipfs/OmRWiFfGzhtxMLdrHXeCAPFvqyrQPRebpEzpNANfhfTMxA/block-reader.c 
/* 

A simple Blockchain .dat file reader. 

Dumps the fields from a local Blockchain file. 

To use: 

gee block-reader.c -o block-reader 
./block-reader -/.bitcoin/blocks/blkXXXXX.dat 

Remove the usleep() calls to make it dump faster, but it's 
not worth it because the program will spit it out way 
too much information. The next version will actually 



do something with the information, but for now this is 
a good starting point. 

*/ 


[hide] 

»3606b9ed9281 e90064 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <b20e61 47963231 1@web.oniichan.onion> 
Date: Sun Nov 20 08:58:31 201 6 


»e5a83dib5b 

we're going to need those now 


[hide] 

6 

»7babc65affcafe6dda [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <088491479639435@web.oniichan.onion> 
Date: Sun Nov 20 10:57:15 2016 


»3606b9ed92 
they never listen 


[hide] 

»e796b94e1 058e3d7bb [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <f8a851 479640645@2hu.tld> 
Date: Sun Nov 20 1 1 :1 7:25 201 6 




1479448424771 .gif 
Pilger RT interview CGI? 

https://twitter.com/Zanting/status/800249726Q33534976 

Some people are using those two vidoes as proof of concept that CGI is possible 

https://www. youtube. com/watch?v=I314XLZ59iw https://www.youtube.com/watch?v=ohmaiJTcpNk 

But tbh to me it seems like glitch during video rendering. 


[hide] 

& 

»0c2d82a1 4370b5585a [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <cb51f1479645700@web.oniichan.onion> 
Date: Sun Nov 20 1 2:41 :40 201 6 


»e796b94e!0 

that video is shopped 

confirmed 


[hide] 

& 

»c7e1 71 e8ad51 f5235f [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <d6c881479645877@web.oniichan.onion> 
Date: Sun Nov 20 1 2:44:37 201 6 


»e796b94e!0 



/ipfs/QmRxm5fu8gepQF7crYL74CmB93DR2r5ciMoxK7vQqRKGRK 


[hide] 

3 

»1 232c1 1 a3b81 e91 3f4 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <a20c41 479671 638@2hu.tld> 
Date: Sun Nov 20 1 9:53:58 201 6 


Can we please log the current DDoS. What else is down besides reddit? 


[hide] 

6 

»77189f3dea84b24bb7 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <8b01f1479672486@web.oniichan.onion> 
Date: Sun Nov 20 20:08:06 201 6 


reddit is under DDoS? 


[hide] 

6 

»b733dfda0a2defe3ec [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <45b3b1479674352@web.oniichan.onion> 
Date: Sun Nov 20 20:39:12 201 6 


»77189f3dea 

I think it stopped now but yeah, it was earlier today. Probably not related, but they were trying to look at periscopes in front of the 
embassy. 


[hide] 

»597efc4a51 1 08f9777 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <f0a8c1 479675299@web.oniichan.onion> 
Date: Sun Nov 20 20:54:59 201 6 


>they fell for the reddit meme 


[hide] 

»de1 9fc03d499eb70e4 [Replvl 
Subject: None 
Name: Anonymous 



MessagelD: <5b91d1 479683241 @web.oniichan.onion> 
Date: Sun Nov 20 23:07:21 201 6 


Download salts. png 

OF OB DA 00 FO 35 9A OF wlinsurance-20130815-A.aes256 salt 
Can someone post the other ones? 


[hide] 

6 

»dee896457208ae52fc [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <7729c1479683629@web.oniichan.onion> 
Date: Sun Nov 20 23:1 3:49 201 6 


Download • wll.pnq 


[hide] 

»4b0c1 b7223eacc02b8 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <750961479687354@2hu.tld> 
Date: Mon Nov 21 00:15:54 201 6 



[hide] 

3 

»006fc040585363e8e5 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <f366d1 479687528@2hu.tld> 
Date: Mon Nov 21 00:18:48 2016 


»dee8964572 

Remember Litecoin LQ3B36Yv2rBTxdgAdYpU2UcEZsaNwXeATk 


[hide] 

& 

»eacc07714ba4a6e252 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <8a21d1479689726@web.oniichan.onion> 
Date: Mon Nov 21 00:55:26 201 6 



»dee8964572 

>We R 

>Fine 

>8chan 

>Post 

>FAke 


[hide] 

»861 4639221 6458bceb IRepIvl 
Subject: None 
Name: Anonymous 

MessagelD: <e053f1 4796901 79@web.oniichan.onion> 
Date: Mon Nov 21 01 :02:59 201 6 


The cat with a tie on has to be some kind of code too. 


[hide] 

»5d11da0757232e1b41 [Repivl 
Subject: None 
Name: Anonymous 

MessagelD: <b629e1479692037@web.oniichan.onion> 
Date: Mon Nov 21 01 :33:57 201 6 



»de!9fc03d4 

EVP_BYTESTOKEY CODE: 


>1 cannot understand the flow paths in the OpenSSL code. The whole library is junk. Someone needs to read the code and annotate it 
and tell me which branches it is taking. I am too busy to do this right now. 

Implementations: 

JS: https://github.com/crypto-browserifv/EVP BytesToKey/blob/master/index.is 
JAVA: http://stackoverflow.eom/a/11786924 

Crypto (C++): https://www.cryptopp.com/wiki/OPENSSL EVP BytesToKey 
Python: http://security.stackexchange.eom/a/l 17654 
C#: https://gist.github.com/caspencer/1339719 

Original: https://github.com/openssl/openssl/blob/master/crypto/evp/evp key.c#L74 

>The process by which the password and salt are turned into the key and IV is not documented, but a look at the source code shows 
that it calls the OpenSSL-specific EVP_BytesToKey() function, which uses a custom key derivation function with some repeated 
hashing. This is a non-standard and not-well vetted construct (!) which relies on the MD5 hash function of dubious reputation (!!); that 
function can be changed on the command-line with the undocumented -md flag (!!!); the "iteration count" is set by the enc command 
to 1 and cannot be changed (!!!!). This means that the first 16 bytes of the key will be equal to MD5(passwordllsalt), and that's it. 



>"The first 16 bytes are actually derived using PBKDF1 as defined in PKCS#5 vl.5. The next 16 bytes would be 
MD5(PBKDF1 (PASS WORD, SALT) II PASSWORD II SALT) and the IV would be MD5(MD5(PBKDF1 (PASSWORD, SALT) II 
PASSWORD II SALT) II PASSWORD II SALT)" 

>openssl enc -aes-256-cbc -pass pass:p@ssword -p -in example_in -out example_out 

salt=649722630B6 1 9D74 

key=F6EEA040C6BDD0EF1429C4CF4FE09FD3EAlC9BDE96B6B41DBFF838E408628BBE 
iv =576F5489 1 CADC222492E038F8ECE557 A 

>http://gateway.glop.me/ipfs/QmTm3MJ36RUauRx2AKpgDF6fLWpMwUvdultxf6WaWwRxED/example_in 

>http://gateway.glop.me/ipfs/QmRGV3SqTqAQMdTfMawCfAWuKt3Q7mDtlGG8Bqp7vnUcrg/example_out 


[hide] 

»e9b3e731 1 755599375 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <3fada1479692679@web.oniichan.onion> 
Date: Mon Nov 21 01 :44:39 201 6 




evp.isDownload evp.py 

»5dl lda0757 


[hide] 

»cf57aaaa6aedb7bc8f [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <cf1ff1479693400@web.oniichan.onion> 


Date: Mon Nov 21 01 :56:40 201 6 


Download 



bp.qif 


»5dl lda0757 
»e9b3e731 17 

IMPLEMENTATION BACKUPS: 

Backups 

Implementations: 

JS: https://github.com/crypto-browserifv/EVP BytesToKey/blob/master/index.is 
http://gatewav.glop.me/ipfs/QmarLbzuuH4qUYbiLHru2UvMLpEdznAK5cf4ybo2f79SER/evp.is 

JAVA: http://stackoverflow.eom/a/11786924 

http://gateway.glop.me/ipfs/OmXdKpPhM3dM5hfBKBPalvn44bW2AaBK3pRN7FW64PFEs5/evp.iava 
Crypto (C++): https://www.cryptopp.com/wiki/OPENSSL EVP BytesToKey 

http://gateway.glop.me/ipfs/OmQCTThDLEb72QZNk4FAW9X5ME4wx4z8Jt4GkboxtEddfh/evp.cpp 
Python: http://security.stackexchange.eom/a/l 17654 

http://gatewav.glop.me/ipfs/QmYRMamhkn6LYvG6mH8qhYVbl8vBxl43WLMONNzPkevYu4/evp.py 
C#: https://gist.github.com/caspencer/1339719 

http://gatewav.glop.me/ipfs/QmRbdPFw6hoNxzenJqiP3tKN75J8Tg2hvi4MVtCiHnUGkQ/evp.cs 

Original: https://github.com/openssl/openssl/blob/master/crypto/evp/evp key.c#L74 

http:// gateway. glop.me/ipfs/QmYR4hXHK7 uPGd9i YPiX Y7 i g4gmea2iY3 Wj Y8 gr3Lfk2xK/evp.c 


»b3e2f201 5f2230575b [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <88eb91 4796981 68@web.oniichan.onion> 
Date: Mon Nov 21 03:16:08 2016 



Download: http://gateway.glop.me/ipfs/QmZudb4s2nF5JgdeFAlnKzs6MtvaPr58rR4LzddZqYir3s/evp test.py 
It recreates EVP_BytesToKey completely outside of OpenSSL. 


[hide] 




Example: 

python evp_test.py md5 'p@ssword' '64 97 22 63 OB 61 9D 74’ 
salt=649722630B6 1 9D74 

key=F6EEA040C6BDD0EF1429C4CF4FE09FD3EAlC9BDE96B6B41DBFF838E408628BBE 
iv=576F5489 1 CADC222492E038F8ECE557 A 

Which is the same as doing. 

openssl enc -aes-256-cbc -pass pass:p@ssword -p -in example_in -out example_out 
salt=649722630B619D74 

key=F6EEA040C6BDD0EF1429C4CF4FE09FD3EAlC9BDE96B6B41DBFF838E408628BBE 
iv =576F5489 1 CADC222492E038F8ECE557 A 

http://gateway.glop.me/ipfs/QmTm3MJ36RUauRx2AKpgDF6fLWpMwUvdultxf6WaWwRxED/example in 
http://gatewav.glop.me/ipfs/OmRGV3SqTqAQMdTfMawCfAWuKt307mDtlGG8Bqp7vnUcrg/example out 


[hide] 

3 

»86088fd42ffa2a2007 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <2d91 01 479701 596@2hu.tld> 
Date: Mon Nov 21 04:13:1 6 201 6 


THE 

NANTUCKET 

PROJECT 



ulian Assange- Bitcoin is Much More Than Just a 


Currency. mp4Downloadl 

Friendly reminder. 


I stamps.txt 


https://www. youtube. com/watch?v=MaB3Zw5 p9c&feature=youtu.be&t=7m06s 
Can someone please run this already. It's really simple but no one has done it. 





http://gatewav.glop.me/ipfs/OmXOXg4gMknboHDUHctmfQqZYucv2YaVESerRRrisbZVpH/stamps.txt 


[hide] 

»38f1 Odefl 64fb2d3ca [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <4e2d81 479705546@2hu.tld> 
Date: Mon Nov 21 05:19:06 2016 



wlinsurance-201 3081 5-A.aes256.51 20 

INSURANCE FILE BLOCKS: 


http://gateway.glop.me/ipfs/QmUUiWfl KLshZBQWHDt8yVaabHdMiJA2glmd7YS8qsvMci/insurance.aes256.5120 
http://gatewav.glop.me/ipfs/OmZHmQrNuBLlMJEi3cSn7bYoLShLiqGue5oeqZmcvHtBD6/wlinsurance-20130815-A.aes256.5120 
Post more if you can make them. 

Simply do head -c [number of bytes] [file] > [newfile] 


[hide] 

»6e8a7df3915dae83e3 [Reply] 
Subject: None 



Name: Anonymous 

MessagelD: <74dd1 1479707830@2hu.tld> 
Date: Mon Nov 21 05:57:1 0 201 6 



https://github.eom/openssl/openssl/blob/master/apps/enc.c 


> /* 

> * Note that str is NULL if a key was passed on the command line, so 

> * we get no salt in that case. Is this a bug? 

> */ 


[hide] 

£ 

»db6ae9ff1 1 592f521 b IReolvl 
Subject: None 
Name: Anonymous 

MessagelD: <a67981479769350@web.oniichan.onion> 
Date: Mon Nov 21 23:02:30 201 6 


Romnay n a sidashow Th# rH story you r* 
not haanng about Is a rayon witniri in* US 
Intebgance Community 



»9e2581f80d 
NORMIE DUMP: 

Tutorial (getting cablegate.zip and other files): 

https://www.reddit.eom/r/WhereIsAssange/comments/5e55p3/a simple blockchain decoding tutorial/ 

Code: 

http://gatewav.glop.me/ipfs/OmSU67Ei3TerNe32CcZTgd48iKqsVvBTgeralqBWFiKK9V/iean.py 
http://gateway.glop.me/ipfs/OmburFHeUtM3wdrEi3rmUuBkx6iDmYpreyGCvHiigJhZnh/iean b.py 
http://gatewav.glop.me/ipfs/OmafUK8hYKztKD3hNNzF4EsW3N5nUcNvHZ4auEidiLkqJd/iean2.py 
http://gatewav.glop.me/ipfs/OmaVdcqSowfbr58295ipeZxUU97FmqLXBadBgicXwuqXa9/block-opretum-finder.py 



http:// gateway, glop. me/ipfs/OmRWiFfGzhtxMLdrHXeCAPFvqyrOPRebpEzpNANfhfTMxA/block-reader.c 

https://codepaste.net/gh3mui 

https://codepaste.net/flca5s 

https://codepaste.net/2kk75e 

https://codepaste.net/4ynlvy 

Leads: 

Blocks 434304-435711, 383000-383100 

http://s6424n4x4bsmqs27.onion/.media/t 8bb6afe8feb8a9836a9b23a505cl4809-imagepng 

691dd277dc0e90a462a3d652al 171686de49cfl9067cd33c7df0392833fb986a 

7379ab5047bl43c0b6cfe5d8d79ad240b4b4f8cced55aa26f86dld3d370c0d4c 

d3c 1 cb2cdbf07c25e3c5f5 1 3de5ee3608 1 a7c590e62 1 f 1 f 1 eab62e8d4b50b6 35 

Cce82f3bde0537f82a55f3b8458cb50d632977f85c81dad3el983a3348638f5c 

2al4783f74796ace53e0a6859a7012723d3d6cd9dacf72d4e90a3394484093df 

657aecafe66d729d2e2f6f325fcc4acb8501d8f02512dlf5042a36ddlbbd21dl 

05e6c80d9d6469e7d 1 328e89b9d97 lb 19972594701586bbcbd70070f2be799db 

623463a2a8a949e0590ffe6b2fd3e4el028b2b99c747e82e899da4485eb0b6be 

5143cf232576ae53e8991ca389334563fl4ea7a7c507a3e081fbef2538c84f6e 

https://blockchain.info/tx/6ad9a4728d3a06dc6452324f67cf5dea9a8bc5b286089e6a04b884135b9dafe0 
https://bitcointalk.org/index. php?topic=260881 

'"Important"' dates: 

>18 October: large number of Wikileaks bitcoin transactions 
https://blockchain.info/address/lHB5XMLmzFVi8ALi6mfBsbifRoD4miY36v 

>26 October (01:21:35): Endchan post on how to use bitcoin data to produce cables. 
https ://endchan. xyz/pol/res/20366 . html#20607 

>26 October (02:00:00) Bitcoing transaction fees increase dramatically, occurs 39 minutes after the above post. 
https://imgur.eom/a/steMy 

>26 Oct: The blockchain is blocked with $10 fees, 43000 unconfirmed transactions appear in the mempool, Bitcoin 0.13.1 is released 
and a 'soft fork' begins: 
https://bitcoin.org/en/release/vO. 13.1 
https://endchan. xyz/pol/res/20366. html#q20647 

>7 Nov: Absurdly high transaction fees. 

https://www.reddit.eom/r/Bitcoin/comments/5bizrb/lblock confirmation fee estimates are absurdly/ 

>Misc attacks: 

https://np.reddit.eom/r/WhereIsAssange/comments/5dtsnc/blockchaininfo most widely used site to check/ 
https://np.reddit.eom/r/Bitcoin/comments/5731is/it looks like blockchaininfo has been dns hijacked/ 


[hide] 

»db0dab7b4ae7420326 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <4bc001479776532@web.oniichan.onion> 
Date: Tue Nov 22 01 :02:1 2 201 6 




[[[ To any NSA and FBI agents reading my message: please consider ]]] 

[[[ whether defending the US Constitution against all enemies, ]]] 

[[[ foreign or domestic, requires you to follow Snowden's example. ]]] 

>Canary not updated for a week: 

>https://riseup.net/pl/about-us/canary 
>Fingerprints no longer appear: 

>https://riseup.net/pl/security /network-security/certificates 
>Fingerprints deleted: 

>https://github.com/riseupnet/riseup_help/commit/8a8c98e0aaa635130a899cl980569f34633dl59d 
>https://twitter.com/riseupnet/status/797 142735283257345 


[hide] 
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»5fb9c40c1dd8c58a9d [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <a837f1479779244@web.oniichan.onion> 
Date: Tue Nov 22 01 :47:24 201 6 


>trusting literal communists 

you got what was advertised so I don't get what you're whining about. 


[hide] 

::> 

»97460203af4e18eab9 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <f63d81 479836633@2hu.tld> 
Date: Tue Nov 22 1 7:43:53 201 6 


»e5a83dlb5b 

Please post this as soon as you can. 


[hide] 

# 

»75d8c1 1 c3fd22a86f4 [Replvl 
Subject: nice bait 
Name: baited faggot 
MessagelD: <4a2c1 1479846426@chan> 
Date: Tue Nov 22 20:27:06 201 6 



»97460203af4el8eab9 

Meet 

»7babc65affcafe6dda 

>2hu.tld 

>clearnet 

>asking for tor only chan 
>nice bait 

If you are being real here then go to #wikileaks on i2p's ire I can give you about two that are still running but if you don't hurry my 
internet will cut again : A ) (because it's shit and I need a new one) 


[hide] 
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»c78f76928ac30f5d20 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <7a0021 479851 363@web.oniichan.onion> 
Date: Tue Nov 22 21 :49:23 201 6 



HOW TO GET THE KEYS (AND MORE) FROM THE BLOCKCHAIN: 

The goal is to make very simple code that is easy to use and understand so that everyone can do this. This is a rough explanation of 
how it works. 

There are two main approaches users are taking to decode messages in the blockchain. Scanning transactions, let's call this 'tx 
scanning', and scanning blocks, let's call this 'block scanning'. The main reason users are not yet able to see meaningful content is 
because both approaches have to be combined. 

TX SCANNING: 

When you scan by transactions, you look for a transaction number (tx id), and decode its contents. When you know the tx id, you can 
easily see which wallets were involved. Some messages require you to combine the decoded data from multiple tx ids. You can 
identify which tx ids are relevant by looking at transaction histories of the wallets involved. This strategy is used for the 'Cablegate 
Backup’. In that case, the list of tx ids is directly told to the readers in the first message. However, you can compile this list on your 
own by 'tx crawling’. To do this, follow these steps: 

. For each tx, look at the wallets that received money and find those that spend it (in this case it is only one per tx). 

. For that wallet, look at its transaction history and find a transaction that follows a similar pattern, i.e., it involves multiple wallets and 
only one spends the funds. 

. Continue doing this until you are not able to see the pattern repeat itself. 

BLOCK SCANNING: 

When you scan by block, you will be able to find encoded data more easily but it is harder to extract the tx id and wallets. One benefit 
of block scanning is that you can explicitly search for file headers and important strings. For example you can directly search for the 
magic numbers in GPG files. When you find one of these, you can then tx crawl from that starting point in order to get all pieces of 
the file. More concretely, if you want to find the Cablegate Backup with a block scanner, you could search for the magic number of 
Zip files. Then, when one is found, you can find the tx id that contains it, and finally tx crawl to get all the pieces. Yet, file headers are 
just one of the many other patterns that can be used to find important transactions. Examples of others are: 

. Magic numbers: Look for the first bytes in different types of file, ’file' can be used in UNIX. 

. Ability to compress: Compress the decoded output. If the size is reduced, the output is possibly a message or part of a file. 

. Text: If the decoded output has text, it might have information. 

. Keywords (Very important): Search for relevant keywords, e.g., checksums for files in Wikileaks.org, checksums for the insurance 
files, hashes, dates, names, time stamps, etc. 

. Reversibility: Some messages are in reverse and need to be flipped. This should be tried both before and after decoding. 



Both scanners have to be used. The starting points for the searches should be Wikileak's wallet, important dates (for example, during 
the DDoS attacks), previous messages and checksum hashes. The Cablegate Backup was a bit simpler than the more recent messages. 
In that case, only one wallet spent the funds in each transaction, and simply looking at wallet's next transaction was enough to find all 
the pieces. Newer messages are bit more complicated. Some of the wallets that receive money make multiple transactions with no 
encoded data before proceeding with the 'real' transaction. Moreover, in a lot of cases, all wallets involved spend the funds (not just 
one). Therefore, the crawler has to keep track of all wallets that receive funds, and all future transactions of that wallet while using 
techniques (like those above) to detect encoded data. A transaction tree should be kept and the pieces of each files should be combined 
in multiple orderings. 

If you implement the process described above you will find all the keys, other backups and other files that are not released. One way 
to test your code is to search for checksum hashes for files that have already been published at a specific date. There are multiple 
messages in the blockchain that include file hashes and dates. 

I recommend you use a local copy of the blockchain and carry out the search on a computer that has no internet access. Work in 
groups and share the process. Remember to look at other cryptocurrencies as well and to encode your findings into the blockchain 
yourself. 

Good luck! 


[hide] 

(S 

»d4501 e846bea64066f [Reply! 

Subject: None 
Name: otherFag 

MessagelD: <5b4d01479857181@web.oniichan.onion> 
Date: Tue Nov 22 23:26:21 201 6 


' 

.rnrtc nrrr?mrrrm i ???6 • an •$ i irrr^ ijt rar?f r? 
|c< irmetrrr^rrrjgrrmfirriTrrTtu momnn : f ?T7"ifini/?»n*i»“”7T! • i ^ 

t|VU| | lT>lTr> 7r ' ■? 


7379ab5047b143c0b6cfe5d8d79ad240b4b4f8cced55aa26f86d1d3d370c0d4c 

OK so walked away for a few weeks b/c was tracking down something else. But that something else I think is only gonna work out if 
this WL nut gets cracked. 

So I ran the python3 version of the jean script on the first suspect TX 
7379ab5047bl43c0b6cfe5d8d79ad240b4b4f8cced55aa26f86dld3d370c0d4c 

I get txt 

>file attached 


[hide] 
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»a0237b7c1 9329b2d83 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <9b8541 479861 066@web.oniichan.onion> 
Date: Wed Nov 23 00:31 :06 201 6 



p»Tf «|K< l‘ » KGB*- K|< 
I I* 1 : K, I (9-h 


*i »>*•?>* ri«*i t>#»! 

*»^ft 


Downloadl 

7379ab5047b143c0b6cfe5d8d79ad240b4b4f8cced55aa26f86d1d3d370c0d4c 

»d4501e846b 

This is what you should be getting. 

Do a diff and compare it to yours. 


[hide] 

»00e48a2707370ba7d8 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <a796d1 47986221 8@web.oniichan.onion> 
Date: Wed Nov 23 00:50:1 8 201 6 


»a0237b7c!9 
yeah not even close... 

I’ll dive in deeper tomorrow and see why it is so different. The cablegate TX worked fine though 


[hide] 
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»5f3fec1744adea6d66 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <430b61 47986531 9@web.oniichan.onion> 
Date: Wed Nov 23 01 :41 :59 201 6 


https://github.com/maximilliangeorge/wikileaks-block-collector 


[hide] 

»ec1 61 0659a081 d8c09 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <de9ba1479875096@chan> 
Date: Wed Nov 23 04:24:56 2016 


»db0dab7b4a 

What if: the USA means nothing, since your technology and society has been already sold to international banks. 



Here's the shit, if you idiots haven't gotten it: "USA" doesn't exist. It's no longer a nation. The "Constitution" means nothing. Why 
follow a "martyr" that desires a country that no longer exists. 

»5fb9c40cld 
This pretty much. 


[hide] 
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»0b65397c833f382b72 [Repivl 
Subject: None 
Name: Anonymous 

MessagelD: <a55c81479882378@web.oniichan.onion> 
Date: Wed Nov 23 06:26:1 8 201 6 


Mirroring an interesting post from htt p://s6424n4x4bsmqs27. onion/pol/res/20366. html#22993 before it gets modded. 

You can archive this to if you are fast... 

Leaving the data time along with the post number in for you to check. 

Anonymous 11/23/2016 (Wed) 06:10:36 [Preview] No. 22993 del 

I might be compromised. So, before I get silenced. I'd like to present some tips for those investigating the blockchain angle (in the case 
that I am unable to continue my work): 

1. Sort transactions based on TX Fees. The DMS TX(s) will probably have a high fee associated with it to a) ensure its inclusion in the 
block (against the spamming attacks we're seeing) and b) draw attention to it. If a transaction contains an OP_RETURN and has an 
unusually high fee, IT IS WORTH INVESTIGATING. 

2. Look for duplicate OP_RETURN data. Provided there wasn't a lone machine setup to post the DMS, it would likely be posted twice 
or more. Create a script to store transactions in a database. Store block number, date, op_return, fee and amount (if any of the outputs 
contain "911", also pay attention.) 

3. The DMS will likely NOT come from the Wikileaks address (but might go to it). In the event that the server(s) hosting the DMS got 
compromised, the attacker would have access to that address' private key (and thus all of WikiLeaks' funds). 

4. This address might be worth investigating: htt 

ps://blockchain.info/address/lNquFlc4AuKx9YJtP9SsiGqhazfa72yPBM?offset=100&filter=0 

Many OP_RETURNs and all on the 10/16/2016 within a period of a few hours. I have not had the chance to investigate further. 

Some side notes: 

Bootstrap8080.bitmessage.org and Bootstrap8444.bitmessage.org were down last night around 3AM (USA time). Worth checking 
DNS history on these to ensure they weren't compromised. 

My computer is sending ICMP packets routinely to addresses in San Francisco and UK. This is one of my reasons to suspect 
compromise (could these be packing non-erronous data?). 

If you don't hear from me within a week, consider me silenced. Solution to hash below will be posted as Proof of Identity at a later 
date. 

a52a2c343c800197eeb29766 147f26e50aac8dfd2b62 1 eb 1 f8085dc2 1 26d7bd0 


[hide] 

»878dc43eb9ddb0defd [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <7a951 1479898251 @web.oniichan.onion> 
Date: Wed Nov 23 1 0:50:51 201 6 



»0b65397c83 

>My computer is sending ICMP packets routinely to addresses in San Francisco and UK. This is one of my reasons to suspect 
compromise (could these be packing non-erronous data?). 

>Solution to hash below will be posted as Proof of Identity at a later date. 
>a52a2c343c800197eeb29766147f26e50aac8dfd2b621eblf8085dc2126d7bd0 
baaaaaaaaaaaaaaaaaaaad opsec 
baaaaaaaaaaaaaaaaaaaaaaaaaad 

dunno whether to reply or just laugh. 


[hide] 
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»d1 bf72c6e4b6aa5eb9 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <fa4e91 47991 4754@web.oniichan.onion> 
Date: Wed Nov 23 1 5:25:54 201 6 


»a0237b7c!9 

Ok so not sure what changed from when I ran it yesterday, but my output file on 

7379ab5047bl43c0b6cfe5d8d79ad240b4b4f8cced55aa26f86dld3d370c0d4c seems to match (just by my eye) the one you uploaded. 
But when I run diff it still says it's different (assume b/c of filename?) and when I run file on it I get DOS executable instead of GPG 
symmetrically encrypted data (CAST5 cipher) which seems to be what it's suppose to output. 

I also ran d3clcb2cdbf07c25e3c5f513de5ee36081a7c590e621flfleab62e8d4b50b635 and it file also reports DOS exe on that one as 
well. 

I am going to start tracing TX now to see if I can get the 130 TX that was used as the example for the cablegate zip. Just trying to do 
due diligence on recreating the steps before jumping into tracing the TX on/around OCT 16 like I was originally doing a few weeks 
back. 


[hide] 

i 

»92ff52d6ee7146d8b2 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <ba48f1 47991 5444@web.oniichan.onion> 
Date: Wed Nov 23 1 5:37:24 201 6 


»878dc43eb9ddb0defd 

Just laugh, he doesn't know what a firewall is or text modification along with anyone could solve the hash and post the solution. 


[hide] 
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»e58f8a07fd610add00 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <eac1 51 47991 8554@web.oniichan.onion> 
Date: Wed Nov 23 1 6:29:1 4 201 6 


how are these TX: 

7379ab5047bl43c0b6cfe5d8d79ad240b4b4f8cced55aa26f86dld3d370c0d4c 
d3c 1 cb2cdbf07c25e3c5f5 1 3de5ee3608 1 a7c590e62 1 f 1 f 1 eab62e8d4b50b635 
Cce82f3bde0537f82a55f3b8458cb50d632977f85c81dad3el983a3348638f5c 



2al4783f74796ace53e0a6859a7012723d3d6cd9dacf72d4e90a3394484093df 
657aecafe66d729d2e2f6f325fcc4acb850 1 d8f025 12d 1 f5042a36ddlbbd2 1 d 1 
05e6c80d9d6469e7dl328e89b9d971bl9972594701586bbcbd70070f2be799db 
623463a2a8a949e0590ffe6b2fd3e4el028b2b99c747e82e899da4485eb0b6be 
5143cf232576ae53e8991ca389334563fl4ea7a7c507a3e081fbef2538c84f6e 

tied to WL? Other than the amount and escrow I can't find how they are connected to WL. I traced the wallets that the BC came from 
and where the change went (several accounts deep) and can not find how these TX originated/end up with WL. 


[hide] 
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»e75b436d6996d45f3a [Repivl 
Subject: None 
Name: shasta 

MessagelD: <287531 479921 229@web.oniichan.onion> 
Date: Wed Nov 23 1 7:1 3:49 201 6 


Download ‘ "* 1 NguFI c4AuKx9YJtP9SsiGahazfa72vPBM wallet. png 

»92ff52d6ee 

repost from end- 

FWIW - 1 pulled the TX for that suspect wallet (lNquFlc4AuKx9YJtP9SsjGqhazfa72yPBM) and it has 535 TX broken up into a few 
different timestamps all on OCT 16. 

4-0.00157125 @ 18:55 
43 - 0.0001293 @ 19:46 
226 - 0.0001293 @ 19:52 
260 - 0.0001293 @ 20:41 
1 -0.0001543 @ 21:18 <— lastTX 

also - the output address for all the TX are not able to be decoded (strange!) 

>pic related 

I have them all in a csv if someone wants to try and run it through the py script for multiple TX. I can’t get that script to work for me. 


[hide] 
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»a6e7de8e1eaff977f8 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <b28cf1479923786@web.oniichan.onion> 
Date: Wed Nov 23 1 7:56:26 201 6 



Download 

d1f776ac2ec96c29ca0b050e0808ed1 68954860a0f6ab3f7c0be5593583c2084-201 61 016-1946 
»e75b436d69 

>43 - 0.0001293 @ 19:46 

each of those strings is 40 bytes x 43 = 1720 bytes/1.72 Kb 

I only went through the first 3 each 40 bytes = 180 bytes but put together in one string = 208 bytes. Weird, maybe... probably not 
thinking through it correctly right now. But the first string of this set of 43 is attached 


[hide] 
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»77a171dc8b87ebbd30 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <40bb21479925370@web.oniichan.onion> 
Date: Wed Nov 23 1 8:22:50 201 6 


»75d8cl lc3f 

>i2p's ire I can give you about two 

Please let me know when you are able to do this. 

»e75b436d69 

Can you upload the csv here? 


»e58f8a07fd 


[hide] 
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»6ad2894ab0274c9acb [Reply] 

Subject: None 
Name: shasta 

MessagelD: <bcb591479926502@web.oniichan.onion> 
Date: Wed Nov 23 1 8:41 :42 201 6 






B.aes256.51 20Download wlinsurance-201 3081 5-C.aes256.51 20 

file snippets 


[hide] 

» 1 f27cd89c1 1 45ccd3f [Reply] 

Subject: None 
Name: shasta 

MessagelD: <0a9701479926634@web.oniichan.onion> 
Date: Wed Nov 23 1 8:43:54 201 6 



Download historv-1 6-1 0-201 6-1 6-1 0-201 6. csv 

»77al71dc8b 

csv of that wallet on Oct 16 


[hide] 

»953db33e1 b070b57df [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <c2e921479930078@web.oniichan.onion> 
Date: Wed Nov 23 1 9:41 :1 8 201 6 


»0b65397c83 

>fees 

There were some recent spikes in fees on Oct 27, Nov 7, and yesterday (Nov 22). This is easy to verify and there are several links to 
sources in this thread. It could be a coincidence, but these increases have taken place when users have found new information and 
attempted to encode it in the BTC blockchain. This can be verified by looking at the dates of certain posts in this thread. Large fees 
and a flooded mempol prevent us from encoding messages for others to recreate what was done here. However, there are other 
cryptocurrencies. I recommend pushing to BTC, Litecoin, and another cryptocurrency that starts with the letter 'M'. 

>Look for duplicate OP_RETURN data 
This is very important. 

>if any of the outputs contain "911", also pay attention. 

Some suspect that these transactions are made by BTC bot/scammers. I’ll post some of that information for completeness. I don’t 
recommend anyone follow this lead directly as the steps posted above are sufficient for users to find all of the messages. Kelly 
Kolisnik tweeted lBpjNVeYm6kiER2m7N6FXy3zNZbqEkplTm on Nov 21st. That wallet is involved in a 91 1 transaction which can 
be seen here: https://blockchain.info/tx/dfd7522529bd9af9556d68af2214a068f6de66b5ell488e84deede26c817bde6 Taking 
Snowden's tweeted hash and turning it into a BTC wallet results in lEnDZkT8Thep9sfbAy5gwg23EHhZw7tYwg. If you look at that 
wallet, you will see several transactions with 911. https://blockchain.info/address/lEnDZkT8Thep9sfbAy5gwg23EHhZw7tYwg Note 
the dates and compare them to the date of the tweet 

>ICMP packets 

It’s good to have firewalls and to use something like Wireshark to track what’s going on. However, I strongly recommend you do all 
your blockchain work in a computer that’s not connected to the internet. When you find something and want to communicate your 
findings to others, use redundancy. My advice is to post the information on a darknet site, clearnet site, regular site, BM, and in person 
to someone in your group. In that order. If you are able to encode messages into the blockchain, that should be the first thing that is 
done. If you find something sensitive in the blockchain, do not send others any information about what is it, or where it was found. 
Instead, send them an actual piece of the blockchain that contains it first, and then explain. 


[hide] 


<s 

»4e5688bfff7670b41 b [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <18b4d1479930866@web.oniichan.onion> 
Date: Wed Nov 23 1 9:54:26 201 6 


»6ad2894ab0 

SALTS: 

insurance. aes256 DE 18 IB 73 EFF3 5E 39 DA 
wlinsurance-20 1308 1 5- A. aes256 OF OB DA 00 FO 35 9A OF C8 
wlinsurance-20 1308 1 5-B .aes256 AB C2 04 75 6B AB 85 BE 30 
wlinsurance-20 1308 1 5-C. aes256 73 6B 46 4C 2F 84 9A C2 A4 

INSURANCE SNIPPETS: 

http://gatewav.glop.me/ipfs/OmUUiWflKLshZBQWHDt8vVaabHdMiJA2glmd7YS8qsvMci/insurance.aes256.5120 

http://gatewav.glop.me/ipfs/QmZHmQrNuBLlMJEi3cSn7bYoLShLiqGue5oeqZmcvHtBD6/wlinsurance-20130815-A.aes256.5120 

http://gatewav.glop.me/ipfs/QmRRAnoHgZGqMrJodHA3Ni6GeQ5i4ylAHUbG8MgVXWshMH/wlinsurance-20130815- 

B. aes256.5120 

http:// gateway. glop.me/ipfs/QmPCPmG w yCghyMrVENUB 1 AEbzkZ9dULE9rB Jc VMqc5RG 1 M/wlinsurance-20 130815- 

C. aes256.5120 

http://gatewav.glop.me/ipfs/QmNdwpvqWXkYsxPnioL8rSZZpVDRDNu3YYvddsQ7dLdrEC/2016-06-03 insurance. aes256.5 120 


[hide] 

6 

»36a331 99089091 71 d3 [Replvl 
Subject: None 
Name: shasta 

MessagelD: <267b81 479931 925@web.oniichan.onion> 
Date: Wed Nov 23 20:1 2:05 201 6 



f 

Download 

'1 

2016-11-07 WL-lnsurance EC.aes256.5120Download 

PJ 

20 

16-11-07 WL-lnsurance UK.aes256.5120Download 



2016-11-07 WL-lnsurance US.aes256.5120Download 



wikileaks-insurance-201 20222.tar.bz2.aes. 51 20 

remainder insurance snippets 


[hide] 

»505a696a3c4f0b8031 [Repivl 
Subject: None 
Name: Anonymous 

MessagelD: <42921 1479932504@web.oniichan.onion> 
Date: Wed Nov 23 20:21 :44 201 6 


»cf7ef0caf8 

http://8ch.net/pol/res/8319373.html 


[hide] 

i 

»5257babec83166d3cd [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <9cfdd1 479939429@web.oniichan.onion> 
Date: Wed Nov 23 22:1 7:09 201 6 


»77al71dc8b87ebbd30 

Alright my time is in UTC so 1 1/24/2016 01:00:00 


If you can't make it then just ask anonlobo for the sites, I should of left him a message to send them to you. 


[hide] 




»83d81 059da9a636225 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <6200b1479939947@web.oniichan.onion> 
Date: Wed Nov 23 22:25:47 201 6 


»4e5688bfff 

»36a3319908 

INSURANCE SNIPPETS: 

http://gatewav.glop.me/ipfs/OmUUiWflKLshZBQWHDt8yVaabHdMiJA2glmd7YS8qsvMci/insurance.aes256.5120 

http://gatewav.glop.me/ipfs/QmZHmOrNuBLlMJEi3cSn7bYoLShLiqGue5oeqZmcvHtBD6/wlinsurance-20130815-A.aes256.5120 

http://gatewav.glop.me/ipfs/QmRRAnoHgZGqMrJodHA3Ni6GeQ5i4ylAHUbG8MgVXWshMH/wlinsurance-20130815- 

B. aes256.5120 

http://gatewav.glop.me/ipfs/OmPCPmGwyCghvMrVENUBlAEbzkZ9dULE9rBJcVMqc5RGlM/wlinsurance-20130815- 

C. aes256.5120 

http://gatewav.glop.me/ipfs/OmNdwpvqWXkYsxPnioL8rSZZpVDRDNu3YYvddsQ7dLdrEC/2016-06-03 insurance. aes256.5 120 
http://gatewav.glop.me/ipfs/QmcDMXxr99Fi583oZKYqFzg8TwomugeV49oFkMrtGHEJ6Z/2016-ll-07 WL- 
Insurance EC.acs256.5 120 

http:// gateway. glop.me/ipfs/QmP AoxkRc JERJEyj 3uXsnKwe8 1 9 WkqnX2Gp 1 V gpoaxLtys/20 16-11 -07 WL- 
Insurance UK.aes256,5 1 20 

http:// gateway. glop.me/ipfs/QmaYUUco 1 V tV urovbrtboMvu6kvFp9pdz6CEA97ftxoi y5/20 16-11 -07 WL-Insurance U S . aes256.5 1 20 


»904c98a1 84e6db0b1 9 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <aeb851 479941 708@web.oniichan.onion> 
Date: Wed Nov 23 22:55:08 201 6 


[hide] 





send-op-return.py 

CODE (ENCODING): 

http://gatewav.glop.me/ipfs/OmXV7haSznR3LQtrVEeirSQueVbZlu5s6ASGHCfWVnNvbD/bitcoin-insertion-tool.pv 

http://gatewav.glop.me/ipfs/Qmdd3u4FdrMwM5z4MfgCAwnDkXTb6taUXdlFAlDrimrvhh/send-op-return.py 

https://21.co/learn/embedding-data-blockchain-op-return/#creating-and-sending-the-transaction 


[hide] 

»f023e1 32dadc82db42 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <526ec1479944895@web.oniichan.onion> 
Date: Wed Nov 23 23:48:1 5 201 6 


DISINFO: 

TuringThe2nd @TuringThe2nd Nov 5 
It is near. 

8 1 Ib7e49274a0 1 9cf2402eb9ebd7ffcdc6d02 1 c25 1 c85fb62 1 8e2828935eff35 
@wikileaks 

0 replies 11 retweets 17 likes 
TuringThe2nd @TuringThe2nd Oct 18 

Time is running out. 40a861f05c8a98cc88594781d81bf233flfal If56f340135e30c41d78808273f 
0 replies 15 retweets 16 likes 
TuringThe2nd @TuringThe2nd Oct 17 



@wikileaks You will need this a bit later. #WikiLeaks 8089b0f7040ab3225dff8313fdb366decdc58dcdc409bc91f825e79bf756b4fd 


[hide] 

6 

»1 071 a7d26944d289b8 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <5dd081 479946661 @web.oniichan.onion> 
Date: Thu Nov 24 00:1 7:41 201 6 


RIP Wikileaks 
2006 - 2016 

https://twitter.com/CommunityWL/status/801556815955820544 

https://our.wikileaks.org/Main Page 
https://our.wikileaks.Org/Category:Investigations 
https://our.wikileaks.org/Getting Started 


[hide] 

6 

»01 dfc2a8ea81 fdf2ff [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <a1 a3d1 479949978@web.oniichan.onion> 
Date: Thu Nov 24 01 :1 2:58 201 6 


tx dc88c8a9fe6cd63dl2da51e2306682b8e3159750823cb2f748e03f9e928d96d5 


[hide] 

6 

»45d6ccd831 ef582c59 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <3073c1479973692@web.oniichan.onion> 
Date: Thu Nov 24 07:48:1 2 201 6 




get wallet txs.py 

While we wait to get a proper database... here's a script that will give you a transaction list for each BTC address (it just scrapes 
blockchain.info): 

http://gatewav.glop.me/ipfs/QmS6c014HgdfR8H2RLStTsYP8oikoMrwYQDLf243rtuoJ8/get wallet txs.py 
https://codepaste.net/rzo26r 

Example: 

python get_wallet_txs.py UVQwlsiukrxGFTZykXFDtcf6SExJVuTVE 
Will save the list to lJVQwlsiukrxGFTZykXFDtcf6SExJVuTVE_tx_list.txt 



And here's a script to find transactions with encoded files. Scans all transactions made by a wallet. Prints tx id and file type. Saves 
decoded data and a list of tx ids. 

https://codepaste.net/dmlhyo 

http://gatewav.glop.me/ipfs/QmPidNDvo9Zn89BeGsFMErhiQ9zcurkVYCveJC6pC9fKHo/get files in wallet.py 
Setup: 

Download TrID http://markO.net/soft-trid-e.html 
Do 'chmod +x trid' 

Download tridupdate.py http://markO.net/download/tridupdate.zip 
Do 'python tridupdate.py' 

TrID and get_files_in_wallet.py should be in the same directory. 

Example: 

python get_files_in_wallet.py 1 C3 WStWpfCmsoG5 WmDea YS w AeEY 1 nc W Qoh 

It should find a PDF. It will save all decoded data from transactions, a list of tx ids and a list of tx ids that include file headers. 


[hide] 

»34b2b57728bf084998 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <8c75a1479974886@web.oniichan.onion> 
Date: Thu Nov 24 08:08:06 201 6 



Ml **. 1 -'.* M , !*• 9I>« | *UU . • .4 ( « 


Id3c1 cb2cdbf07c25e3c5f51 3de5ee36081 a7c590e621 f 1 f 1 eab62e8d4b50b635 


»45d6ccd831 



python get_files_in_wallet.py 16jv3REqedeiTK8dzygyirNLWiP5gAc2KX 

Collecting data from file: Cee82f3bde0537f82a55f3b8458cb50d632977f85e81dad3el983a3348638f5c 
100.0% (.PGP/GPG) PGP symmetric key encrypted message (salted+iterated) (3001/2) 
d3c 1 cb2cdbf07c25e3c5f5 1 3de5ee3608 1 a7c590e62 1 f 1 f 1 eab62e8d4b50b635 

Collecting data from file: d3clcb2cdbf07c25e3c5f513de5ee36081a7c590e621flfleab62e8d4b50b635 
100.0% (.PGP/GPG) PGP symmetric key encrypted message (salted+iterated) (3001/2) 

2 transactions found 
2 file headers found 


[hide] 

6 

»89004de07d4fb1 bl 0a [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <276b71480022826@web.oniichan.onion> 
Date: Thu Nov 24 21 :27:06 201 6 




python get_files_in_wallet.py 3CaaFJF39T9TWiNtCKTnU79A3NvGeWKdqL 

Ieef3c9474a065b38cfb8blcac0ce6efl5517381 Ie0fdfb04a54df2a0ef74b40 
100.0% (.FLC) FLIC FLC video (1/1) 

52968900d9963e854a84a6dbda0a87dl511e65cel0d4ccf2a46b72f52509d2eb 
100.0% (.FLC) FLIC FLC video (1/1) 

533bd9226bbe9ef9d7625910da39db27ea0b780d36bc8dl3fac4c879aa56fcfe 
c 1 39c0b63 1 d969dd98ed 14fd0aa 1 1 29957b62689a9 1 98656dl 57963e54fb04ee 
100.0% (.FLC) FLIC FLC video (1/1) 

Ifbcff35263al7061f58d9b41900cc9ac44f879d534729582f666dc289b48794 
100.0% (.FLC) FLIC FLC video (1/1) 

4c729d0c64a40e4eb 1 624e8f3a499354a30508b643248b9a953 1 af7 1 6c4a5 a90 
100.0% (.FLC) FLIC FLC video (1/1) 

7d43580841bc8b8baaa3097fllc83fea454a56535a34a49350bl2a9cfdabb7ac 
100.0% (.FLC) FLIC FLC video (1/1) 


[hide] 



& 

»a3540f5558fc690a25 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <cdc3f1 48002441 6@web.oniichan.onion> 
Date: Thu Nov 24 21 :53:36 201 6 



python get_files_in_wallet.py lKEyVEndor3p6c3NL2UiVhscXPZKb3DfYl 

d68a906b0608e8feb6402830b0f2961b296dl 18cb6c825ace4ebd48db05f3fl7 
100.0% (.MP3) MP3 audio (1000/1) 

c0e9 1 8dd lb 1 97f04fd 15a569fdc377bd9e0a7987b969d 1 4dc295cddba5c60dc 1 
100.0% (.DMG) Disk Image (Macintosh) (1000/1) 

8003eef72e31269c0668358189ec9dc6bfc259df86d3e49c7b77ae0e247fc489 
100.0% (.BS/BIN) PrintFox (C64) bitmap (1000/1) 

dcd2d0ca8a4a20ecd4382el0bl0058e706f2dl 154a9332ea99c7be52aabe4f0e 
100.0% (.) QuickBasic BSAVE binary data (1000/1) 

8143f7dfbb9e8e2311a41014358adf057312063786a9280f0193e00e481cf25e 
100.0% (.FLI) FLIC FLI video (1/1) 

C98al4c83d2ca53e54e97db8360f2efb0bfel05d63d81 1274212ee28b5cbf465 
100.0% (.FLI) FLIC FLI video (1/1) 

8c79839b7d7088efbf56945c08a6cce4db4ac625c527fl70143e085401 la0625 
100.0% (.DMG) Disk Image (Macintosh) (1000/1) 

b043983e0556c73a5f48bc680a70a5f842241eb7cc4c5889a71575633ac0d221 
100.0% (.DMG) Disk Image (Macintosh) (1000/1) 

09a86aa780980cd5f66f966c8bf3009dlc028d5caa6a3e373f70e6986ca60144 
100.0% (.INI) Generic INI configuration (1000/1) 

4bb09877350505dd2070f4391acd6251e8c5b4e89da4855delc964fe99ef819d 
"T00.0% (.GPG) GNU Privacy Guard public keyring (1000/1)'" 

bcea9f0a0306ef209 19251 a002ce3 1 294e82dfa7 1 7f30b3a5c555e 1 2095e83c 1 
100.0% (.INI) Generic INI configuration (1000/1) 

9df5abc2ce02d9471deba79b067fd3ca0ffa227f0efaccdf616al45371c68a35 
100.0% (.FLI) FLIC FLI video (1/1) 

C2ce449c33071a6773306928bf65960de98974a6c2afea8d81cc66e63ff70d43 
100.0% (.FLI) FLIC FLI video (1/1) 



100.0% (.) QuickBasic BSAVE binary data (1000/1) 

8c7878202c2c3059cebl3e0afd95271cc95e451fc2blff09ef6a533bc5f99450 
100.0% (.FLI) FLIC FLI video (1/1) 

466be482c0d3e4aafefd21b2183b68297610df08228e7c3449f6bc9037dld3e5 
100.0% (.FLI) FLIC FLI video (1/1) 

68dd95b4c35c9el4225930cffl771d6098df766bc77091a457dd653b07033314 
100.0% (.FLI) FLIC FLI video (1/1) 

7524a456d0257d9 1 e3786al 64 1 29a2 1 467ed6345fc8 1 440 1 e 1 fb84609c3B679 
100.0% (.) QuickBasic BSAVE binary data (1000/1) 

4bd6d 1 a297c7be 1 3 1 3b 1 d4fce 1 2 1447e0ec43cb94ac277477fbf97c522e 1 e8e6 
100.0% (.) QuickBasic BSAVE binary data (1000/1) 

23ff44669130dl6e7dedec7eb63373fa78d003aecl058aeb8fe8ceffe3803c54 
100.0% (.) QuickBasic BSAVE binary data (1000/1) 

04aa8970c6e5da0a359a34ecab203bfb036dc 1 9dc2a2da06526 1 fe2c00e7a209 
100.0% (.PGC) PGN (Portable Gaming Notation) Compressed format (1000/1) 

48dd7a482143c3124fcc588b985eca8420e6eb5ddbfe216fflc067c4f3979e45 
100.0% (.PGC) PGN (Portable Gaming Notation) Compressed format (1000/1) 

C8485e58eal51cd452b9bbc4a6b84345895f3c31156adf906b7dc3b4f669c222 
100.0% (.FLI) FLIC FLI video (1/1) 


[hide] 

»900a05880f96ebc7de [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <fc1 abl 480025947@web.oniichan.onion> 
Date: Thu Nov 24 22:1 9:07 201 6 


Using Wikileaks' address 

python get_files_in_wallet.py lHB5XMLmzFVj8ALj6mfBsbifRoD4miY36v 

1 3bd667802cc58936996dbf5defd2307b7 1 6e 1 f84a9908de0c77f3c 1 a3b4cde3 
100.0% (.FLI) FLIC FLI video (1/1) 

8218ab03d82ebfa309aceedb484e695bc058f080397d7794826c9efcld0287b7 
100.0% (.) QuickBasic BSAVE binary data (1000/1) 

c06244b 1 da9edb9da54736c 17cf8d92cc754e 1 cd 1 09c5a9858d7eb 1 07079ff3 1 
100.0% (.FLI) FLIC FLI video (1/1) 

6571600fac324166a566d4702acbd799e8e4a2f70498989cdffa204578660970 
100.0% (.VC) VisiCalc spreadsheet (1000/1) 

9d765d8074e9b85afa9f2868af61271b2043ddde365d9446c9b5afa5905d6f53 
100.0% (.PGC) PGN (Portable Gaming Notation) Compressed format (1000/1) 

05fb32e6188df3381bl9fd2cb81e5eb4c6ab0ddc885a6b3b6f87f2a5fdf4240e 
100.0% (.PGC) PGN (Portable Gaming Notation) Compressed format (1000/1) 



4a88c0c359c26fef3cc507463336alc77dl87fbc3bf7bda509fb2flb5f8762e5 
100.0% (.) QuickBasic BSAVE binary data (1000/1) 

97b2ee5fc43d24912da36ba62795884068alb0086d5c0d3d65bad5ccca637e77 
100.0% (.) QuickBasic BSAVE binary data (1000/1) 

d2be0169c5b5fccfd853a2391c6e3fc2e68a9efcbbecc842ecd98a41c58f85a0 
100.0% (.MUX) MUX video (2000/1) 


[hide] 

6 

»7fdb66e34973aa6bb5 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <eeca31480027492@web.oniichan.onion> 
Date: Thu Nov 24 22:44:52 201 6 



»900a05880f 
2016-10-31 01:44:57 

4a88c0c359c26fef3cc507463336alc77dl87fbc3bf7bda509fb2flb5f8762e5 
100.0% (.) QuickBasic BSAVE binary data (1000/1) 

2016-10-13 11:16:34 

97b2ee5fc43d24912da36ba62795884068alb0086d5c0d3d65bad5ccca637e77 
100.0% (.) QuickBasic BSAVE binary data (1000/1) 

2016-10-11 10:47:33 

d2be0169c5b5fccfd853a2391c6e3fc2e68a9efcbbecc842ecd98a41c58f85a0 
100.0% (.MUX) MUX video (2000/1) 




[hide] 

»ca5a801 c995fbff474 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <3639e1480029906@web.oniichan.onion> 
Date: Thu Nov 24 23:25:06 201 6 


• .v^ 1ZU/7*4 6 f- T->fc I (k>|k«U > f ft* ^kTo | 


2767c5a7386aa02b973e88304bdc1 2d91 5831 46c94f90e91 075042a1 64c93d05Download 



2016-08-26 23:23:10 

2767c5a7386aa02b973e88304bdcl2d91583146c94f90e91075042al64c93d05 
100.0% (.GPG) GNU Privacy Guard public keyring (1000/1) 


2016-07-25 03:43:10 

eb75ada9646771a94d8c46d86f52923e2c0d2302bae73a0ddal4ac842836f4ce 
100.0% (.GPG) GNU Privacy Guard public keyring (1000/1) 

2016-07-25 01:08:54 


[hide] 

»98a6657a0d81 27f99b [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <fff161480034054@web.oniichan.onion> 
Date: Fri Nov 25 00:34:14 2016 




C336d08c199ea108cd1c9e8fb3da289fc0887e85cb9fd53cb56a0b8041d05838 Download 


r lt Un«K-GlH!>'iK» AT B )lAllMjOtr-|n«!rKr^3iig*lr| H|l(fA'} »*e|*C*|HmrSl|y«ri 
Uft-tet.lV' * m:-|* 

I3Ai it.dhf 



dfd8c3c9b535551 945645e21 2852df757763eedc2b05ae56ec6df1 beb51 1 1 05 


»7fdb66e349 

»ca5a801c99 

C336d08cl99eal08cdlc9e8fb3da289fc0887e85cb9fd53cb56a0b8041d05838 
100.0% (.DMG) Disk Image (Macintosh) (1000/1) 2016-07-24 22:30:48 

fdfd8c3c9b53555 1945645e2 12852df757763eedc2b05ae56ec6dflbeb5 11105 
100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-07-14 08:44:12 

f6046148a74fa880403c630de743f7d01736725d941e744ce0c89baa098287ec 
100.0% (.FLI) FLIC FLI video (1/1) 2016-05-24 21:39:18 


[hide] 

& 

»e485dd840fe9f7a484 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <2a9001480035989@web.oniichan.onion> 
Date: Fri Nov 25 01 :06:29 201 6 





»900a05880f 

»7fdb66e349 

»ca5a801c99 

»98a6657a0d 


http://gateway.glop.me/ipfs/QniZFkRKoGkv5zBVisbYvR9iniGgvgEsutUnbdNXxcPbrZrZ/iean3.pv 

https://codepaste.net/q893m5 

>IIRC it does what jean3.py was supposed to do. That means there's only two more scripts left to recreate all the previous steps. 

>Setting up TrID: 

> 

>Download TrID http://markO.net/soft-trid-e.html 
>chmod +x trid 

>Download tridupdate.py http://markO.net/download/tridupdate.zip 
>python tridupdate.py 

>Setting up output: 

> 

>mdkir dataout 
>mv trid dataout/. 

>Then use like this: 

> - 

>python jean3.py lHB5XMLmzFVj8ALj6mfBsbifRoD4miY36v 

>Results: 

> 

>A11 decoded data will be in the dataout folder. lHB5XMLmzFVj8ALj6mfBsbifRoD4miY36v_file_tx_list.txt will have a list of the 
transactions and the type of file found in them. 

>Misc: 

> 

>If you want to start at a specific page you can change 'startatpage'. It would also be very easy to start a specific date (use datel and 
date2). 

>Cheers 


2767c5a7386aa02b973e88304bdcl2d91583146c94f90e91075042al64c93d05 
100.0% (.GPG) GNU Privacy Guard public keyring (1000/1) 2016-08-26 23:23:10 

eb75ada9646771a94d8c46d86f52923e2c0d2302bae73a0ddal4ac842836f4ce 



100.0% (.GPG) GNU Privacy Guard public keyring (1000/1) 2016-07-25 03:43:10 

fdfd8c3c9b53555 1945645e2 12852df757763eedc2b05ae56ec6dflbeb5 11105 
100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-07-14 08:44:12 

C336d08cl99eal08cdlc9e8fb3da289fc0887e85cb9fd53cb56a0b8041d05838 
100.0% (.DMG) Disk Image (Macintosh) (1000/1) 2016-07-24 22:30:48 

f6046148a74fa880403c630de743f7d01736725d941e744ce0c89baa098287ec 
100.0% (.FLI) FLIC FLI video (1/1) 2016-05-24 21:39:18 

042clcd09ec672e2d504b76el6398c62396fa57ab0004a793dfc68d49d3e4cc9 
100.0% (.BS/BIN) PrintFox (C64) bitmap (1000/1) 2016-04-24 07:47:50 

83f7a29360abe4e927ae25ad803d2a28d088dll9a47941fe0c42445bb2e78730 
100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04-21 06:17:47 

ad85d76b5fd006cb3f08edda4d80327f425caed83aeb20aaa0c0ed28 1064484b 
100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04-14 19:14:05 

fa3e0d76b55e01c45dd4218a41794f39b3792310cfla88f3502824e4afc3e867 
100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04-14 02:26:40 

6ea5ff73db5259 1 66 1 ff7c0c7eb 1 6 1594b67b8e 1 29ccc2e 1429fe0c7 1 d69e 1 ff 
100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04-13 23:05:59 

35bfef9b0febbf3b 1 Cefbd8f503e90d997e55d9f384 1 e45f359529debd6c lbca 
100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04-13 22:07:46 

7fd3 1 fccd96a3e94c2 1 dl 5b45ae 1 957c22fe5 1 al aa6cb 1 8f054bda20966304ac 
100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04-13 04:22:39 

78a013b6c857f5535b9133896d4cll5d2bbel5995a28a71f63049bf3bdcbleba 
100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04-12 22:23:58 


[hide] 

»7dcb1 1 cfa66f 1 23ce4 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <b1c6f1 480051 900@web.oniichan.onion> 
Date: Fri Nov 25 05:31 :40 201 6 


»900a05880f 

»7fdb66e349 

»ca5a801c99 

»98a6657a0d 

»e485dd840f 

2767c5a7386aa02b973e88304bdcl2d91583146c94f90e91075042al64c93d05 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1) 2016-08-26 23:23: 10 

eb75ada9646771a94d8c46d86f52923e2c0d2302bae73a0ddal4ac842836f4ce 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1) 2016-07-25 03:43: 10 

C336d08cl99eal08cdlc9e8fb3da289fc0887e85cb9fd53cb56a0b8041d05838 100.0% (.DMG) Disk Image (Macintosh) (1000/1) 2016- 
07-24 22:30:48 

fdfd8c3c9b53555 1945645e2 12852df757763eedc2b05ae56ec6dflbeb5 11105 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-07-14 
08:44:12 

2767c5a7386aa02b973e88304bdcl2d91583146c94f90e91075042al64c93d05 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1) 2016-08-26 23:23: 10 

eb75ada9646771a94d8c46d86f52923e2c0d2302bae73a0ddal4ac842836f4ce 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1) 2016-07-25 03:43:10 



eb75ada9646771a94d8c46d86f52923e2c0d2302bae73a0ddal4ac842836f4ce 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1) 2016-07-25 03:43:10 

C336d08cl99eal08cdlc9e8fb3da289fc0887e85cb9fd53cb56a0b8041d05838 100.0% (.DMG) Disk Image (Macintosh) (1000/1) 2016- 
07-24 22:30:48 

fdfd8c3c9b53555 1945645e2 12852df757763eedc2b05ae56ec6dflbeb5 11105 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-07-14 
08:44:12 

f6046148a74fa880403c630de743f7d01736725d941e744ce0c89baa098287ec 100.0% (.FLI) FLIC FLI video (1/1) 2016-05-24 
21:39:18 

042clcd09ec672e2d504b76el6398c62396fa57ab0004a793dfc68d49d3e4cc9 100.0% (.BS/BIN) PrintFox (C64) bitmap (1000/1) 
2016-04-24 07:47:50 

83f7a29360abe4e927ae25ad803d2a28d088dll9a47941fe0c42445bb2e78730 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04- 
21 06:17:47 

ad85d76b5fd006cb3f08edda4d80327f425caed83aeb20aaa0c0ed28 1064484b 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04-14 
19:14:05 

fa3e0d76b55e01c45dd4218a41794G9b3792310cfla88f3502824e4afc3e867 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04-14 
02:26:40 

6ea5ff73db52591661ff7c0c7ebl61594b67b8el29ccc2el429fe0c71d69elff 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04-13 
23:05:59 

35bfef9b0febbf3blcefbd8f503e90d997e55d9f3841e45f359529debd6clbca 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04-13 
22:07:46 

7fd31fccd96a3e94c21dl5b45ael957c22fe51alaa6cbl8f054bda20966304ac 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04-13 
04:22:39 

78a013b6c857f5535b9133896d4cll5d2bbel5995a28a71f63049bf3bdcbleba 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04- 
12 22:23:58 

eb75ada9646771a94d8c46d86f52923e2c0d2302bae73a0ddal4ac842836f4ce 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1) 2016-07-25 03:43: 10 

C336d08cl99eal08cdlc9e8fb3da289fc0887e85cb9fd53cb56a0b8041d05838 100.0% (.DMG) Disk Image (Macintosh) (1000/1) 2016- 
07-24 22:30:48 

fdfd8c3c9b53555 1945645e2 12852df757763eedc2b05ae56ec6dflbeb5 11105 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-07-14 
08:44:12 

f6046148a74fa880403c630de743f7d01736725d941e744ce0c89baa098287ec 100.0% (.FLI) FLIC FLI video (1/1) 2016-05-24 
21:39:18 

042c 1 cd09ec672e2d504b76e 1 6398c62396fa57ab0004a793dfc68d49d3e4c c9 100.0% (.BS/BIN) PrintFox (C64) bitmap (1000/1) 
2016-04-24 07:47:50 

83f7a29360abe4e927ae25ad803d2a28d088dll9a47941fe0c42445bb2e78730 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04- 
21 06:17:47 

ad85d76b5fd006cb3f08edda4d80327f425caed83aeb20aaa0c0ed28 1064484b 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04-14 
19:14:05 

fa3e0d76b55e01c45dd4218a41794G9b3792310cfla88f3502824e4afc3e867 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04-14 
02:26:40 

6ea5ff73db52591661ff7c0c7ebl61594b67b8el29ccc2el429fe0c71d69elff 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04-13 
23:05:59 

35bfef9b0febbf3blcefbd8f503e90d997e55d9f3841e45f359529debd6clbca 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04-13 
22:07:46 

7fd31fccd96a3e94c21dl5b45ael957c22fe51alaa6cbl8f054bda20966304ac 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04-13 
04:22:39 

78a013b6c857f5535b9133896d4cll5d2bbel5995a28a71f63049bf3bdcbleba 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04- 
12 22:23:58 

aa3bf652dc745e8al265c3641858e9a75e4cd3ee85eb843033b4302e2dec5fc7 100.0% (.FLC) FLIC FLC video (1/1) 2016-04-06 
05:53:04 

b4c38335541fd578bdc4d45ala4a47e3baadd2a55ae41c0e5535eb4307d49b24 100.0% (.PGC) PGN (Portable Gaming Notation) 
Compressed format (1000/1) 2016-03-18 18:12:19 

b20ad5f8b75bael6a6dle3de2fb25910be868f936a6e3cc3d997598dcedl4f89 100.0% (.FLI) FLIC FLI video (1/1) 2016-03-15 
21:19:44 

24b0967ecca36dd455b9a96e48d8c0fl3a36acdd37290f6baae3c50b7065627e 99.9% (.MP3) MP3 audio (1000/1) 2015-11-28 
09:53:31 

32d71a560a965fel7ca5a652202844f5bb580dl85e38485aacad8717485b0b8e 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2015-11- 
20 21:53:12 

03e8a9bl 197744012af33c642671ed8eb50fd2d442d4875a3274f730ac2ca951 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2015-11- 
19 22:16:50 

2a38f95db552a52aefa82565ffd81e885103738da25627fle894f5892a672325 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2015-11-12 
18:27:54 



15d4f6606f7ad966e27f9628acf3cl929eb50cb2fef0ecb949fb8941b94254cc 100.0% (.MP3) MP3 audio (1000/1)2015-11-06 10:47:37 
13bd667802cc58936996dbf5defd2307b716elf84a9908de0c77f3cla3b4cde3 100.0% (.FLI) FLIC FLI video (1/1) 2016-11-21 
18:23:36 

8218ab03d82ebfa309aceedb484e695bc058f080397d7794826c9efcld0287b7 100.0% (.) QuickBasic BSAVE binary data (1000/1) 
2016-11-15 19:41:03 

C06244blda9edb9da54736cl7cf8d92cc754elcdl09c5a9858d7ebl07079ff31 100.0% (.FLI) FLIC FLI video (1/1) 2016-11-09 
18:46:55 


[hide] 

»b92f6d1 59d2dcc0b1 6 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <ce9a61 48009841 4@2hu.tld> 
Date: Fri Nov 25 1 8:26:54 201 6 



wikileaks-did-91 1 .jpg 


Even if the keys were released, where would you post any information about the contents of the files. No place exists that is not a 
controlled, opposition space. 

Facebook, Twitter, Reddit? You get the idea. The whole internet is built on backdoored standards. The existing internet is completely 
corporate controlled and in the hands of the enemy. 

We have seen evidence of websites being intercepted and content being removed in real time. They will let some leaks out, but there is 
not a channel for mass dissemination and media for this type of leak. 

- The insurance files should be downloaded quitely to as many people as possible. 

- We should verify the hashes of the wikileaks files (multiple hashes and verifications). Expecially for the newer files and the saudi 
file that was modified 

- We should build up or fortify our distribution system for messages 

- We should build up a toolchain for writing messages to the blockchain and retrieving the messages (as a stop gap in case Bitmessage 
comes under complete exploitation) 

- The enemy has a nuke button and can dump 10 GB per day into bitmessage and make it unusable if needed 

- We should prepare for the private key distribution (which is expected to happen by Christmas if it has not already happened) 

- We should each individually be able to decrypt the files. We should not expect that the files will be allowed on websites or public 
internet 

- If we cannot post files on Bitmessage and the clearnet is jammed, how will we even distribute the worst of the files? We wont be 
able to. Each person needs to get the files themselves, decrypt them and may have to do sneakernet or we may have to distribute the 
worst information on USB sticks. 

- We need tools to posting to the blockchain as a last resort 

Sending a message on the blockchain may cost us 10 cents or $5 but if it is important enough, that may be the only way. 

In the long term, we need to develop new media platforms and communication platforms that are more resilliant. 

- more difficult to jam 

- more difficult to modify content once published 

- ability to detect jamming if it is occuring. 

We need distributed blogging and messaging platforms. We need a safe and secure way of distributing files. 


Hi everyone. 


I realize that this message might not go through but just in case — this will be my final message sent to BM. Anyone claiming to be 
updating my situation is lying. 

I've been working with another person on this since the original thread in October 17. This is our third attempt at spreading the 
information. I don't think it will be possible for anyone to upload the keys and the files. It really seems like the only way is for 
everyone to get them from the blockchain separately. Some of you might think this is not the case but you'll be able to see it first hand 
when you try soon. It should be fairly straight forward for everyone to extract the keys and files with the information on this BM. 

On our end, we can confirm that the script can be used to extract the following files: 

2016 Disk Image, Spreadsheet, BIN, multiple videos, mp3s, emails, pdf documents 
2015 Disk Image, Spreadsheet, multiple videos, mp3s 
2014 Disk Image, Spreadsheet, multiple videos 
2013 several backups in zipfiles 

Hash and time stamp text for what seems like all uploads to Wikileaks.org 

The following files can be unlocked so far: 

20 1 6-06-03_insurance . aes256 . torrent 
wlinsurance-20 1308 1 5- A. aes256 
wlinsurance-20 1308 1 5-B .aes256 
wlinsurance-20 1308 1 5-C. aes256 

We have not been able to unlock: 

2016-11 -07_WL-Insurance_U S . aes256 
2016-11 -07_WL-Insurance_UK. aes256 
2016-11 -07_WL-Insurance_UK. aes256 
wikileaks -insurance -20 1 20222 . tar.bz2. aes 

Allegedly unlocked by others: 

2016-06-03_insurance.aes256 
wikileaks-insurance-20120222.tar.bz2. aes 

There is clearly a lot more information that we haven't gotten to yet. 

The file pieces have to be combined so a bit more code is needed. The Cablegate Backup should be used as an example to do it. Some 
groups are now going through the same issues we've seen. Our experience was that we lose internet connection, we are unable to copy 
paste or keep anything on our clipboards, all attempts at encoding transactions into BTC get delayed and do not happen, files on 
computers connected to the Internet are deleted or moved, etc. That is why I think the best way to spread this is to teach others how to 
do it and possibly to encode what you feel comfortable making permanent in some crypto currency other than BTC. 

I expect that in the next few days the media will be forced to cover this. The spin will be that these files cannot be verified, do not 
come from Wikileaks and that no one can recreate the steps to get them. They will probably push false steps that do not work. From 
what we have seen, most people will not bother to check and believe it. Because the blockchain is permanent and many have copies, I 
do not think that it will be possible to spin this in this way forever. Anyone can do it in their own homes. However, they have been 
preparing for this for months. Damage control will be very easy for them because there are really no sites that can be used to discuss 
this anymore. I'm a still a bit concerned because the steps on how to get the information were available since mid October and very 
few people tried to do it. It was practically impossible for us to try to discuss this with others on any site. Everyone seems to react 
violently to the suggestion but I am not sure if these were even real responses. 

The easiest way to collect the information is on a computer that is not connected to the internet and has no wifi cards. Making a 
database with relational information of the transactions helps a lot as well. It might be necessary for someone to create a very easy to 
follow tutorial with code that allows anyone to do this. To this day many people refuse try on their own and simply chose to believe 
that it is not real. If you care about this, you should spend some time showing people the evidence and guiding them through of 
process of getting the files themselves. 

My personal opinion is that the most crucial thing that should happen when this is finally out in the open is that the people pretending 
to be Wikileaks should be exposed. It should be clear to everyone that people are paying attention. The people that sold out and did as 
they were told should also be exposed. I still don't understand why it was so easy to get most people to play along and allow their sites 



to be controlled. It is alarming that talking about this is practically forbidden everywhere. During the past few months we have 
witnessed a possible end of a free internet. People in power have the resources to fool the entire world into agreeing with them through 
censorship, paid posts, bots, etc. There is not even a way to verify the history of a page anymore since they now control the only site 
that allowed it. I think this is the perfect opportunity to guarantee that this is stopped and does not happen again. However, everyone 
should see the information and decide by themselves what they want to do. 

Thanks to all of you that helped. 


[hide] 

»1 6f958062f803b301 a [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <1 87061 480098491 @2hu.tld> 
Date: Fri Nov 25 18:28:11 2016 



Join LARP chan! BM-2cX3hsRXiz3WxF6HMNQutkLAzC34feswfa and participate in our "conspiracy fighting" with elements of 
MMOARG :) 

If you want to play one of these games: 

"I found keys to WikiLeaks insurance files" 

"Someone found keys to WikiLeaks insurance files" 

"Someone have hidden keys to Wikileaks insurance files" 

"There are messages/keys hidden in blockchain" 

"I just created a nice C/C++/C#/Python/Ruby/bash/DOS batch/Turbo Pascal code to read secret messages from blockchain! Check it 
out!" 

"People are disappearing!" 

"I found secret messages in {someone} tweets!" 

"NSA is disrupting my internet connection" 

"NSA is censoring things in realtime!" 

"A cat from embassy is telling me things" 

"Assange is dead" 

"Assange is kidnapped" 

"I found magic bug in OpenSSL which breaks all SSL crypto!" 

"We need to communicate by secret SHA256 chans" 



then join LARP today! This chan is for you and all your conspiracy/LARP needs! 

BitMessage channel: Address: BM-2cX3hsRXiz3WxF6HMNQutkLAzC34feswfa Name:LARP 


[hide] 
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»ad9a49d3e5e41eec4c [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <9f041 14801 02525@web.oniichan.onion> 
Date: Fri Nov 25 1 9:35:25 201 6 


»16f958062f 

>To everyone reading this. This place is now full of shills in damage control mode after last night. 

>Trust nothing you read here. If you truly care about this issue, go verify the information yourself. This is why it was designed in this 
way. No one can make any statement about what's in it unless they decoded it themselves. 

>Wikileaks has a time stamp and hash for every single file they publish. If you think this is a lie, listen to Assange himself saying it: 
https://www.youtube.com/watch?v=MaB3Zw5_p9c&feature=youtu.be&t=7m06s Or even better go look in the blockchain and see for 
yourself. 

>When you see this in the blockchain you will see that what people have been trying to communicate to you last night is real and that 
you can verify it. 

>TRUST NO ONE AND USE THE SYSTEM THEY PUT IN PLACE AS IT WAS MEANT TO BE USED. ZERO SPECULATION 
AND OPINIONS. PROVABLE FACTS THAT ARE PERMANENT AND CAN’T BE CHANGED. 


[hide] 

6 

»2dc8fe1fd9fdfd8a72 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <15ea41480104800@web.oniichan.onion> 
Date: Fri Nov 25 20:1 3:20 201 6 


For publishers for example, so that, as an example we are starting to use Bitcoin, Wikileaks, stuffing our, cryptographic keys of stuff 
that we publish, so, '"we prove that we have published stuff at a particular time by stuffing it in Bitcoin, in the blockchain'", and then, 
'"if someone were to come and try to modify the material that we have published’", to take a particular part, ’"that would be 
detectable"'. -Julian Assange 

https://www. youtube. com/watch?v=MaB3Zw5 p9c&feature=youtu.be&t=7m06s 

Anyone that is skeptical of the information you have extracted from the blockchain is only attempting to discredit you. Every person 
that truly cares about verifying this information does not go online to ask others. Those who want real evidence go and verify it 
themselves. This is the way the system was meant to be used. You have the blockchain. You have direct access to the information. 
There is no need for opinions, speculations, reports, or analysis by other parties. The only evidence that matters is the evidence you, 
the reader, are able to test on your own. The system helps you detect the people that are attempting to influence you. If you need to ask 
others how to obtain the information you are admitting that you do not want to independently verify this information and are instead 
dependent on others. This dependence on others is what allows censorship and it is precisely the reason information is encoded in this 
way. If someone tells you they were not able to find anything you can prove that they are lying. You have a permanent source of 
information that can not be modified. Use it as it was designed to be used. 


[hide] 



»c305652abf50431 b22 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <976a71480107590@web.oniichan.onion> 
Date: Fri Nov 25 20:59:50 201 6 


Critical 

• • •••••• •• •••••• 

Thinking 


PC6 TITTlt 

Download critical-thinking. png 

"The code in there is not meant for people to use it. It is meant for people to understand how to do it. It's a proof of concept. Again, 
stop depending on others. That's why the information is encoded in this way, so that no one can discredit it and everyone can verify it. 

If the keys somehow survived here. EVERYONE would stop looking at the blockchain (which has a lot more than the keys in it, 
including evidence that todays leaks are fake). Most of you probably have version of the insurance files that have been modified and it 
would be very easy for someone to send out a key that can be used for these fake files. Then, they will be able to discredit Wikileaks. 


If you have found the keys you will have also found out that the instructions tell you specifically to NOT SPREAD THE KEYS 
directly. 


The system was designed so that everyone independently extracts them from a permanent source of data that cannot be modified. 


Be logical about this. They put a lot of work into this system and it's the ONLY reason no one has come out with fake keys for fake 
files. Because the blockchain TELLS YOU that if you see a key it is not real. 


How has no one figured this out... For fucks sake. " 


[hide] 

f 

»58a1 al 37adc3b774f5 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <7b3ae14801 12925@web.oniichan.onion> 
Date: Fri Nov 25 22:28:45 201 6 


»16f958062f 

idk why but I fuckin lost it on Turbo Pascal 



[hide] 

»6ee231 3bee46ef02dd [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <8344b14801 14498@web.oniichan.onion> 
Date: Fri Nov 25 22:54:58 201 6 


>4. This address might be worth investigating: 

https://blockchain.info/address/lNquFlc4AuKx9YJtP9SsjGqhazfa72yPBM?offset=100&filter=0 Many OP_RETURNs and all on the 
10/16/2016 within a period of a few hours. I have not had the chance to investigate further. 

I am getting 24 file headers, including 3 GPG keyrings, all from from 10/16. It would be interesting to see if these headers are also 
found in other wallets. 

Here are the headers I found: 

Ibeb3fa9277841 18bad5984e6902268c9bacfcea8973el971c2812159939a852 100.0% (.SGF) Smart Game Format (2000/1) 2016-10- 
16 20:41:17 

d2c78418097800a2b91130d97e48bd6al3241a50f5a96196f2dec7bl3a7619fc 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1) 2016-10-16 20:41:17 

0bf3fc7ce906fc370f08e3ced24612d8b8cb75be7633ff69d8d968cf9c2945f5 100.0% (.INI) Generic INI configuration (1000/1) 2016- 
10-16 20:41:17 

7666d77230972d96e64dc68bf8855de235bcc34ealbal63245eda28bb6d518d6 100.0% (.PCI) DEGAS low-res compressed bitmap 
(2000/1)2016-10-16 20:41:17 

C2a6af758fl64ab546942ac859c85e6ba44b983ba60197d8fd0060b00bdd5acc 100.0% (.INI) Generic INI configuration (1000/1) 2016- 
10-16 20:41:17 

2a9553a298deel48e6ba318f00ebcd43f66da582f0bf22c2726e5a81905f85ea 100.0% (.BS/BIN) PrintFox (C64) bitmap (1000/1) 2016- 
10-16 20:41:17 

72d398423cfd078b711dde5bf04557f5efc9f6dd0b5e4caf2721cb4e01dd95fl 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-10-16 
20:41:17 

b9d065flaa82d6894eca3ec6e4ee0a685b060579802376f5bl9cd3fl6add9969 100.0% (.DMG) Disk Image (Macintosh) (1000/1) 2016- 
10-16 20:41:17 

95f095flf40bc9097f21953e7d975b8a3ec0e35fla6c877fcf2d2a606dafaabb 100.0% (.MP3) MP3 audio (1000/1) 2016-10-16 20:41:17 
878785a920238977bb9073ac306c032177c05d3147f8107e0fe335elac71eaa0 100.0% (.) QuickBasic BSAVE binary data (1000/1) 
2016-10-16 20:41:17 

a4a9bf 1 4d0bc5 1 2baf 1 9a8b65a2ce 1 cdc938dd95 1 56202fad9d 1 14e52c37 1 a97 100.0% (.FLI) FLIC FLI video (1/1) 2016-10-16 
20:41:17 

2al0bfb8eea8blbl4eb6ec5dl028375e3dcle8df613128a4c4e0826blb593370 100.0% (.) Java serialized data (2000/1) 2016-10-16 
19:52:34 

bd208e22086a014dabc048d8164ad7e9b9c25a0d7f9efca784577237fe67b737 100.0% (.FLC) FLIC FLC video (1/1) 2016-10-16 
19:52:34 

bb9cbfa2d2dff67704 1 83b69d36dd286aecd5 1 c4e2e6f696bb6al 09bc50b 1 af9 100.0% (.DMG) Disk Image (Macintosh) (1000/1) 2016- 
10-16 19:52:34 

fd73c71bf2f9ddd25d4f95170a5de307219910a69cb99559308aebc3a457aldf 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1) 2016-10-16 19:52:34 

f25affb9cc5d71b436d947f8a3e4efl3acd5101df8bdl23170d846d213aela58 100.0% (.) QuickBasic BSAVE binary data (1000/1) 
2016-10-16 19:52:34 

eed41738ff541ff4aeeb9c0d31G3896dbdf8cl85301326af4ea857564fae918 100.0% (.FLI) FLIC FLI video (1/1) 2016-10-16 19:52:34 
382caa3a30147238aae98db65e7126ce418493ac044d239b208aa2bldf2b64ae 100.0% (.MP3) MP3 audio (1000/1) 2016-10-16 
19:52:34 

f9156aeaae48b080ee74febd0cbbed2f948fe207e6e72132bf3b3db5f3952575 100.0% (.PGC) PGN (Portable Gaming Notation) 
Compressed format (1000/1) 2016-10-16 19:52:34 

56747b8f00b40dlf0a577e0flc38d3fe6f776ffba91827a43951fca75ddb5ce4 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1) 2016-10-16 19:52:34 

C352d9c251fl7afe03f950dfa0e876d77blf8be61b3713aa2f0168880824b3ea 100.0% (.MP3) MP3 audio (1000/1) 2016-10-16 19:46:25 
e893933b297a9a636528alaabe0c427e2317dfc2bc220271ccf31246bafl07df 100.0% (.FLI) FLIC FLI video (1/1) 2016-10-16 
19:46:25 

d28b23830bf810684722c72af4e7e573c89adc77e571b2ae6095deb35dfl a8de 100.0% (.DMG) Disk Image (Macintosh) (1000/1) 2016- 
10-16 19:46:25 



b549bf3d045f87ce766eb50bla64a6843ae8267ece3a383b70bb7d273b860065 100.0% (.MP3) MP3 audio (1000/1) 2016-10-16 
19:46:25 


[hide] 

6 

»2f249cbf02eb3ad90a [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <8557714801 16288@web.oniichan.onion> 
Date: Fri Nov 25 23:24:48 2016 


>When you scan by transactions, you look for a transaction number (tx id), and decode its contents. When you know the tx id, you can 
easily see which wallets were involved. Some messages require you to combine the decoded data from multiple tx ids. You can 
identify which tx ids are relevant by looking at transaction histories of the wallets involved. This strategy is used for the 'Cablegate 
Backup’. In that case, the list of tx ids is directly told to the readers in the first message. However, you can compile this list on your 
own by ’tx crawling’. To do this, follow these steps: 

>. For each tx, look at the wallets that received money and find those that spend it (in this case it is only one per tx). 

>. For that wallet, look at its transaction history and find a transaction that follows a similar pattern, i.e., it involves multiple wallets 
and only one spends the funds. 

>. Continue doing this until you are not able to see the pattern repeat itself. 

Confirming that jean3 is able to find the 7 -zip headers for the cablegate addresses. 

python jean3.py lNT3ACYygZj9YHYsZo7hp2jGEPiUDMqs53 
python jean3.py 1 AuoHX7 VNGGK5 KkkUcB AGG3 RuKgMuRdpMB 
python jean3.py lMe9i8XjbdBVZzgcki4NiPdF6VkYf75ykZ 

All find 1 file header. 

100.0% (.7Z) 7-Zip compressed archive (6000/1) 

(First tx is 5c593b7b71063a01f4128c98e36fb407b00a87454e67b39ad5f8820ebclb2ad5) 


[hide] 

& 

»1 0eb7096735598064c [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <3099d14801 17340@web.oniichan.onion> 
Date: Fri Nov 25 23:42:20 201 6 




Download iean3.ov 

»2f249cbf02 


[hide] 

»9a8c6371 2e6799aadb [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <78e1e1480132954@web.oniichan.onion> 
Date: Sat Nov 26 04:02:34 2016 



d3c.qpqDownload eb7.qpq 

Here are the two gpg keyrings in the WL wallet in case anyone wants play with them. 

(From txs 2767c5a7386aa02b973e88304bdcl2d91583146c94f90e91075042al64c93d05 and 
eb75ada9646771a94d8c46d86f52923e2c0d2302bae73a0ddal4ac842836f4ce) 

http://gatewav.glop.me/ipfs/QmS3zs98mFmvqGdxRaUCrx3e42UsLXQ6VfRpSXrKrk8SAZ/276.gpg 

http://gatewav.glop.me/ipfs/Omaol2d6tWhl5bA5inUYQlpcoTaiMcvb85SNyzrsS25wpFa/eb7.gpg 

To print all the packets do: 

for i in { 1 ..293 }; do echo "Trying bytes: $ { i } " ; tail -c "+${i}" eb7.gpg I gpg -list-packets; done 



for i in { 1 ..9993 } ; do echo "Trying bytes: $ { i } " ; tail -c "+${i}" 276. gpg I gpg -list-packets; done 

and here's three T00.0% (.PGP/GPG) PGP symmetric key encrypted message (salted+iterated)' encoded after the Cablegate backup. 
(From txs: 

7379ab5047bl43c0b6cfe5d8d79ad240b4b4f8cced55aa26f86dld3d370c0d4c 
d3c 1 cb2cdbf07c25e3c5f5 1 3de5ee3608 1 a7c590e62 1 f 1 f 1 eab62e8d4b50b635 
Cce82f3bde0537f82a55f3b8458cb50d632977f85c81dad3el983a3348638f5c) 

http://gatewav.glop.me/ipfs/QmShQicUaKagC6hXzXqCdtRvP8pAXfBkiP5C51XsZVZg2e/737.gpg 

http://gateway.glop.me/ipfs/OmZxXabEusrSK4e9esLGJY7YAqLxxXhXPCvXhNWcnEVQH9/cce.gpg 

http://gatewav.glop.me/ipfs/QmcnVecuQtobYWUkhUHGFLVAzfokQRRYsWKS2iV8bJwsic/d3c.gpg 


[hide] 

»e5b3b010e05ac1fd05 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <e73da1480206884@web.oniichan.onion> 
Date: Sun Nov 27 00:34:44 201 6 



Download code.7z 

Code zip: 

http://gateway.glop.me/ipfs/QmVlZ8kXBFZrLtsGTxTaB9HS6TTDURa27vyFJfAoiJi5wH/code.7z 
To compile: 

gcc bcrdr2.c sha256.c ripe 160. c -lsqlite3 -o bcrdr2 
To Run: 

./bcrdr2 <blocks dir> <database file> 
e.g: 

./bcrdr2 -/.bitcoin/blocks/ out.db 


WHAT IT DOES: 

This program reads through every file named blk*.dat in the folder to point it at and parses it. 
It creates an sqlite3 database with the following schema: 

CREATE TABLE BLOCK(" 



"ID INT PRIMARY KEY NOT NULL," 

"PREV CHAR(64) NOT NULL," 

"MERKLE CHAR(64) NOT NULL," 
"HASH CHAR(64) NOT NULL," 

"NUM INT 

"BITS INT NOT NULL," 

"NONCE INT NOT NULL," 

"TIME INT NOT NULL);"; 


Block header info, including the computed double SHA256 hash for the block. 

PREV is previous block hash, MERKLE is the merkle root hash, HASH is this block's hash. 
The other fields are miscellaneous. 


"CREATE TABLE TX(" 

"ID INT PRIMARY KEY NOT NULL," 

"HASH CHAR(64) NOT NULL," 

"LILE TEXT NOT NULL," 

"OLLSET INT NOT NULL);"; 

Transaction header. 

HASH is this transaction's SHA double hash. 

LILE is the .DAT file's ID that it came from (See the LILE table below to get the file's name) 
OLLSET is the offset in the file it came from. 


"CREATE TABLE TX_INPUT(" \ 

"ID INT PRIMARY KEY NOT NULL," \ 

"TX INT NOT NULL," \ 

"PREV CHAR(64) NOT NULL," \ 

"DATA BLOB NOT NULL," \ 

"IDX INT ," \ 

"SEQ INT );"; 

Input transaction. Here for completeness, not really useful unless you want to verify transactions. (We don’t) 

TX is the transaction it’s part of 

PREV is the previous transaction 

DATA is the raw script data. 

IDX and SEQ are misc fields. 

"CREATE TABLE TX_OUTPUT(" \ 

"ID INT PRIMARY KEY NOT NULL," \ 

"TX INT NOT NULL," \ 

"DATA BLOB NOT NULL," \ 

"ADDR TEXT ," \ 

"VAL BIGINT );"; 

Output transactions. 

TX is the transaction it’s part of. 

DATA is the raw script data. 

ADDR is the transaction address the program tried to figure out given the script in DATA. 

VAL is the bitcoin amount in it's raw format (integer) 

"CREATE TABLE FILE(" \ 

"ID INT PRIMARY KEY NOT NULL," \ 

"NAME FILE NOT NULL);"; 

FILE is the table that simply assigns an ID to each file name for reference in the table above. 


These are relational tables to quickly find parent child relationships, i.e. What TX has what INPUT and vice versa. 

"CREATE TABLE REL_BLOCK_TX(" \ 

"ID INT PRIMARY KEY NOT NULL," \ 



"BLOCK INT NOT NULL," \ 

"TX INT NOT NULL);"; 

Table for Block Transactions 

"CREATE TABLE REL_TX_INPUT(" \ 

"ID INT PRIMARY KEY NOT NULL," \ 

"TX INT NOT NULL," \ 

"INPUT INT NOT NULL);"; 

Table for Input Transactions 

"CREATE TABLE REL_TX_OUTPUT(" \ 

"ID INT PRIMARY KEY NOT NULL," \ 

"TX INT NOT NULL," \ 

"OUTPUT INT NOT NULL);"; 

Table for Output Transactions 

These two aren't used yet, but were intended for linking blocks in a chain (not really needed since all we care about are the 

transactions themselves) 

"CREATE TABLE REL_BLOCK_NEXT(" \ 

"ID INT PRIMARY KEY NOT NULL," \ 

"BLOCK INT NOT NULL," \ 

"NEXT INT NOT NULL);"; 

"CREATE TABLE REL_BLOCK_PREV(" \ 

"ID INT PRIMARY KEY NOT NULL," \ 

"BLOCK INT NOT NULL," \ 

"PREV INT NOT NULL);"; 


I hope my program can be of use to you. You are welcome to share it as needed. 


[hide] 

»9ae31 41 e5e4605951 c [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <bcb791480227443@web.oniichan.onion> 
Date: Sun Nov 27 06:1 7:23 201 6 


>trid marked two transactions as pgp private keyring files between 383000-383100: 

>f286e28e6 1 3fc34 1 D 1 843200fef9f3f 1 1 9783c249f8662cd04 1 75 1 2c3dbd96 1 
>100.0% (.SKR/GPG/PGP) Pretty Good Privacy (PGP) Private/Secret Keyring (v2) (1001/2) 
>Tue Nov 10 00:00:00 2015 
>from block 383001 

>ca3044870b86fef3f3e8d559c81368646f8393667caddla4fc3eb8b212ac3fbe 
>100.0% (.SKR/GPG/PGP) Pretty Good Privacy (PGP) Private/Secret Keyring (v4) (1001/2) 
>Wed Nov 1 1 00:00:00 2015 
f>rom block 383073 


[hide] 

fa 


»cf0c0459de720ea5d4 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <fe69c1 480229499@web.oniichan.onion> 
Date: Sun Nov 27 06:51 :39 201 6 


OP_RETURNS search: 
https://www.smartbit.com.au/op-retums 


[hide] 

»e816fb0fe644dcffa7 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <988de1 480231 053@web.oniichan.onion> 
Date: Sun Nov 27 07:1 7:33 201 6 



>From Wikileaks: 


>7b42129c959b7db85688c5c686cl7eabdal0156138d96fb738fb8f0513dl34af 
>100.0% (.GPG) GNU Privacy Guard public keyring (1000/1) 2016-11-11 17:29:06 


>Good call. We need to run jean3.py again with this change. 

>http://gate way. glop. me/ipfs/QmV7RPtE AkB mXMRgs61rW AKbhLl H3 WNMa87Uj lx6bpRTl l/jean3_8ftx.py 


>1 actually am decoding them slightly differently. Scripts floating around remove the first 8 bytes as per the satoshi downloader. i 
don't remove them unless they are a valid checksum for the rest of the data. 


[hide] 

»1 b5c5a1 2c8b1 Obi e4f [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <00649148023121 6@web.oniichan.onion> 
Date: Sun Nov 27 07:20:16 201 6 




Download iean3 8fix.ov 

»e816fb0fe6 


[hide] 

»f2cd75db8f4e0443ce [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <5d09b1 480231 694@web.oniichan.onion> 
Date: Sun Nov 27 07:28:14 201 6 


»e816fb0fe6 

»lb5c5a!2c8 

>If you use jean3_8fix.py you are not able to detect the cablegate header. It seems like the proper thing to do would be to do 'trid' 
every 8 bytes but that would give us a lot of false positives. 

>In simple terms, some files have the headers in the first 8 bytes, others have it in the first 16. We don't know if some headers could 
be in other parts of the file. 

> Anyone have any ideas? 


[hide] 

»4f7de4ceb69972f1 b6 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <756a01 480231 823@web.oniichan.onion> 
Date: Sun Nov 27 07:30:23 201 6 



Download 259.gpq 

»e816fb0fe6 

>Another from Wikileaks: 

>2593dbef02eeb4c7528773b0bdf0a4aba35ae3471bl07dee49886f8fe894flf0 
>100.0% (.GPG) GNU Privacy Guard public keyring (1000/1) 2016-10-31 19:41:29 


[hide] 

»6edd09ce1 41 0c71 1 3c [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <578831 480232231 @web.oniichan.onion> 
Date: Sun Nov 27 07:37:1 1 201 6 



»e816fb0fe6 

»f2cd75db8f 

»4f7de4ceb6 


17a65dac7d411e6151631025c3b9ab22cf87d6dd4cad67a097903152dab4ab93 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1)2016-10-11 20:28:11 


[hide] 

fa 



»b68554ffbd80887cb0 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <fc8691 480232396@web.oniichan.onion> 
Date: Sun Nov 27 07:39:56 201 6 



Download 15d.qpq 

15dde0ff8e9e213ed20acdb01e3c58faad7491c6f3a93cdc54dba055b45b7371 
15dde0ff8e9e2 1 3ed20acdb0 1 e3c58faad749 1 c6f3a93cdc54dba055b45b737 1 
100.0% (.GPG) GNU Privacy Guard public keyring (1000/1) 2016-07-27 13:21:06 


[hide] 

6 

»3d4c82adf2e58aa4f6 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <60ecb1 4802341 93@web.oniichan.onion> 
Date: Sun Nov 27 08:09:53 201 6 


»e816fb0fe6 

»lb5c5a!2c8 

»f2cd75db8f 

»4f7de4ceb6 

»6edd09cel4 

»b68554ffbd 


Here's what I get so far (using the first 8 bytes for trid) from the Wikileaks address: 

GPG keyrings: 

7b42129c959b7db85688c5c686cl7eabdal0156138d96fb738fb8f0513dl34af 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1) 2016-11-11 17:29:06 

2593dbef02eeb4c7528773b0bdf0a4aba35ae3471bl07dee49886f8fe894flf0 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1) 2016-10-31 19:41:29 

17a65dac7d4 1 1 e6 1 5 1 63 1 025c3b9ab22cf87d6dd4cad67 a097903 1 52dab4ab93 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1)2016-10-11 20:28:11 

15dde0ff8e9e213ed20acdb01e3c58faad7491c6Da93cdc54dba055b45b7371 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1) 2016-07-27 13:21:06 

Everything else: 

7b42129c959b7db85688c5c686cl7eabdal0156138d96fb738fb8f0513dl34af 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1)2016-11-11 17:29:06 



d3d9c958802cdfd30ccbab2a3e3e73a20el Ic767d4ac32e65e6ecc71d6fd4f09 100.0% (.INI) Generic INI configuration (1000/1) 2016- 
11-09 06:34:54 

83dd30fbba775cbddbd6b624c41b95b43b483a99a6272flc8653238clba76238 100.0% (.PGC) PGN (Portable Gaming Notation) 
Compressed format (1000/1) 2016-11-07 18:47:52 

2593dbef02eeb4c7528773b0bdf0a4aba35ae3471bl07dee49886f8fe894flf0 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1)2016-10-31 19:41:29 

4cc85ec53bccld8860bae3e4454f5fe6cala8b6cdd3dc3eeel57e56dad98697a 100.0% (.MP3) MP3 audio (1000/1) 2016-10-22 
03:53:51 

a062037cde0bcca042ad5f636fb3820f9fce2c2383b40e885240635df3339e74 100.0% (.MP3) MP3 audio (1000/1) 2016-10-21 
15:47:59 

f42 1577f8aedcb2 Ie9855al5 13fff37a0f03d79097df323f8d5c33fd8 16701 5f 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-10-19 
16:23:26 

7fce28afdaa30al 19091ab34b0786588ce3f9fl0f21 1882abc3faac82dd3cb61 100.0% (.BS/BIN) PrintFox (C64) bitmap (1000/1) 2016- 
10-17 20:00:56 

faf4edf7f6d6b6438d08658b0edc3cf968beab4ac4e7dbd478daa6bbbbfffef8 100.0% (.) QuickBasic BSAVE binary data (1000/1) 2016- 
10-17 17:20:28 

17a65dac7d411e6151631025c3b9ab22cf87d6dd4cad67a097903152dab4ab93 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1) 2016-10-11 20:28:11 

d8dla712d5eb8ad7a2a0c90d2c97f8113312bda2b35e5636f0e5dl6e0888dd96 100.0% (.YZ1) Deep Freezer compressed archive 
(2000/1) 2016-08-10 22:44:26 

bade24ed0c7d2caa554fld3b2c547a0ab727170blb2a284f794c25004ed533ce 100.0% (.) QuickBasic BSAVE binary data (1000/1) 
2016-07-29 21:15:05 

15dde0ff8e9e213ed20acdb01e3c58faad7491c6f3a93cdc54dba055b45b7371 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1) 2016-07-27 13:21:06 

a2f7fc08979626de88d07a464d74910f37d5068662bf6854be5150aa522eb510 100.0% (.PGC) PGN (Portable Gaming Notation) 
Compressed format (1000/1) 2016-07-23 17:54:53 

7a98alb62cc98ddfa4501a53f74c4d2c56421eae2feae73a2d9d8510c391851 1 100.0% (.PGC) PGN (Portable Gaming Notation) 
Compressed format (1000/1) 2016-06-03 22:46:47 

f6046148a74fa880403c630de743f7d01736725d941e744ce0c89baa098287ec 100.0% (.INI) Generic INI configuration (1000/1) 2016- 
05-24 21:39:18 

aaa8e20d83bb8328e6c2dd32dbd75735dbcb68866663e5al086de9eb52dllaa7 100.0% (.PGC) PGN (Portable Gaming Notation) 
Compressed format (1000/1) 2016-05-06 10:26:07 

042clcd09ec672e2d504b76el6398c62396fa57ab0004a793dfc68d49d3e4cc9 100.0% (.DMG) Disk Image (Macintosh) (1000/1) 
2016-04-24 07:47:50 

Idc6ed6ceb0bf486bf9f2d41d5f627e34b6d237503a4bl379c2eefb45804alc9 100.0% (.BS/BIN) PrintFox (C64) bitmap (1000/1) 2016- 
04-13 03:04:41 

abd836e3a9becfdl273el21e4a91e6f6bfl0727ff73e0aa2ee563dde84696125 100.0% (.DMG) Disk Image (Macintosh) (1000/1) 2016- 
04-12 11:55:14 

9fbb0d75f5b57954db908c06a33646fe5f34678314bfladdd8ee26247dbcc549 100.0% (.) QuickBasic BSAVE binary data (1000/1) 
2016-02-29 06:09:12 

e551cbd5f42bbafa81450bb27db5ea3abd331760668d88bbbc7ded056ceeala8 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-02- 
05 21:35:34 

911ecd4507a44a322225b5b44686e4ac6el3eed060990114162027a37b9d5e29 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-01- 
14 10:49:56 

blca8760485e933d51feal7185fb7d7c44d7ea8cd35e2695b820e5bd577fd720 100.0% (.FLC) FLIC FLC video (1/1) 2015-09-30 
02:16:34 

5228d40cd6b515c26ee8b6aa43c4650caaal5af747ad7al551d3ce2989aa88f8 100.0% (.INI) Generic INI configuration (1000/1) 2015- 
07-17 17:47:39 


[hide] 

£ 

»2cf33af786f3564a9e [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <d25921480234285@web.oniichan.onion> 
Date: Sun Nov 27 08:1 1 :25 201 6 



n 

Download 

»9ae3141e5e 


[hide] 

»d1f7f8e7bb0afad3f4 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <6747f1480234626@web.oniichan.onion> 
Date: Sun Nov 27 08:1 7:06 201 6 


Alright. They need some major improvement anyway. 

http://gatewav.glop.me/ipfs/QmRaJsSCgsw43cBQXSU3ndnuaVw9iNeciq4ixGcfCBdsEu/wltr9.py (MAIN SCRIPT) 

http://gateway.glop.me/ipfs/QmaGtLezTMWCJKiKv6AzfZFs2rHLJrL9KbNHwqopxgnngq/tx.py 

http://gateway.glop.me/ipfs/QmQBYhnAUw7bJPRRoNipzpv7fdHiwk4nQrCbPbcZBNv2vc/blocktx.py 

http://gatewav.glop.me/ipfs/QmWqLTocNgPPVnv3RgRaQa7i7ceqxzX3TDV3PGqfUcs8Y2/blockrtx.py 

http://gateway.glop.me/ipfs/QmZ4UZdg2kXrokUJcTBGMWCKTSYmecBdWkHFAqWNHBtJUA/addrtx.py 

Right now they require 

1. local copy of the blockchain (rpc server) 

2. linux(/osx?) machine 

3. trid downloaded and placed in a directory called "triddir" 

4. python 3 

and probably other stuff I'm missing 
Usage: 

./tx.py [txid] [directory] 

./blocktx [block height] [directory] 

./blockrtx [block height 1] [block height 2] [directory] (All blocks between height 1 and height 2) 

./addrtx [address] [directory] 

Each one creates 3 files in [directory]: 
resfile: Trid output for all transactions without "Unknown!" 
asciifile: Fragments of decoded ascii in output scripts 
txfile: txids for each result in resfile 

as said below, my scripts handle the 8 bytes thing (i think) 


[hide] 



s 

»9f824d35be8ac2df0b [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <a840c1480240635@web.oniichan.onion> 
Date: Sun Nov 27 09:57:15 201 6 



Download insterter.py 

>1 took Satoshi's bitcoin inster code and tried to comment out enough parts to get it to spit out how it would encode a file into BTC 
transactions. 

>You can see it here: 

>http://gateway.glop.me/ipfs/QmejJjc35y7FEGguNTTE3ZeXhpeCklxhAWsA2fS5wYpxHw/insterter.py 
>You can run it like this: 

>python file.zip lHB5XMLmzFVj8ALj6mfBsbifRoD4miY36v 10 .1 
>Hope this can help someone make progress reverse engineering this stuff. 


[hide] 

& 

»b2ab697cccd58855ac [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <b9cd71480302045@web.oniichan.onion> 
Date: Mon Nov 28 03:00:45 201 6 


https://pr0gramm.com/top/1629324 


[hide] 

6 

»e21 bace768d8d 94033 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <dbaca1480303760@web.oniichan.onion> 
Date: Mon Nov 28 03:29:20 201 6 



Download 


fees.pnqDownload 


mem. png 


[hide] 

»11d37f14b6bb93cc1a [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <1a3431480306054@web.oniichan.onion> 
Date: Mon Nov 28 04:07:34 201 6 


Is the BM channel not working? 


[hide] 

6 

»f724c2b3c41 b272ef2 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <7cc8d1 480307879@chan> 
Date: Mon Nov 28 04:37:59 201 6 


>https://8ch. net/tech/res/679042. html just got deleted. 
>Anyone have a backup? They are trying to delete everything. 


[hide] 

6 

»9f0da779777ad4e789 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <86bba1 480308585@web.oniichan.onion> 
Date: Mon Nov 28 04:49:45 201 6 


http://8ch.net/tech/res/679042.html just got deleted. Anyone have a backup? 


[hide] 

»28e1e51d7126ccdec1 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <5c4c41480308765@web.oniichan.onion> 
Date: Mon Nov 28 04:52:45 201 6 


>You may not know what the SDN list (Specially Designated Nationals) is but we ll explain. It’s the US version of Iran and Chinas 
state censorship machine. Initially created with good intent to inform the world (and US entities, persons) of Terrorists, Rogue regimes 
and other wrongdoers. It slowly converted into a censorship list to block free speech on the Internet. You see, by adding a website to 


the list the U.S authorities could then evoke a closure order on the registrar where the domain is registered. Of course, if it’s a .com or 
.org then the US can evoke the said closure order anywhere in the world via ICANN. 

>In 2006 the US censored a series of Cuba websites. Some with benign propaganda about the deceased American writer Ernest 
Hemingway www.Cuba-Hemingway.com while others preyed into the apparently dark and mysterious www.CubanCulture.com . The 
latter may have been added to the list because of the brief article on the locally active black magic and covert babalawos? 

>Shutting down the websites then became easy work. A quick call from a Government office to the US based Enom and ICANN and 
the sites were “disappeared” from worldwide viewing. Gone. . .Two years and counting 

http://www.thecubablog.com/uncategorized/staff/the-us-has-a-way-to-shut-down-wikileaks-the-infamous-sdn-list/ 


[hide] 

6 

»523e4b0fb29bd1 a063 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <658f51 48031 1390@web.oniichan.onion> 
Date: Mon Nov 28 05:36:30 201 6 



8ch.net is now completely down. Please save all threads if possible and post them here. 


[hide] 

6 

»8f1 383c36f2421 da6e [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <99820148031 1560@web.oniichan.onion> 
Date: Mon Nov 28 05:39:20 201 6 


I actually am decoding them slightly differently. Scripts floating around remove the first 8 bytes as per the satoshi downloader. i don't 
remove them unless they are a valid checksum for the rest of the data. 

file headers: http://gateway. glop.me/ipfs/QmbnbcW2 1 gmHs YH9m2NTKLWphGZB5H6wxYZ8rFtKju8Cxf/resfile 
ascii: http://gatewav.glop.me/ipfs/QmafoqorvVJNTtyNDSnkQHrcQa3vqYvPdv6iFiTSPFMaLl/asciifile 

Also found 

574324e77312679f42da66171933fc958eaf05286fb5c8702e4bf679al24f90a 
100.0% (.P7S) PKCS #7 Signature (1001/2) 

Tue Nov 10 00:00:00 2015 
from block 383019 

8e5e6e5e2344983ba4a919113el949ef993406f9e778c310ba9ce0d5edb8f50b 
100.0% (.P7S) PKCS #7 Signature (1001/2) 

Wed Nov 11 00:00:00 2015 
from block 383092 



Most likely coincidences though, after examining the transactions. 


[hide] 

»a1c3503f3ed670d475 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <28188148031 1743@web.oniichan.onion> 
Date: Mon Nov 28 05:42:23 201 6 


http://gateway.glop.me/ipfs/QmS3zs98mFmvqGdxRaUCrx3e42UsLXQ6VfRpSXrKrk8SAZ/276.gpg 
http://gatewav.glop.me/ipfs/QmShOicUaKagC6hXzXqCdtRvP8pAXfBkiP5C51XsZVZg2e/737.gpg 
http://gateway.glop.me/ipfs/QmZxXabEusrSK4e9esLGJY7YAqLxxXhXPCvXhNWcnEVQH9/cce.gpg 
http:// gateway. glop.me/ipfs/Qmcn VecuQtob Y WUkhUHGFL V AzfokQRR Y s WKS2j V8bJwsic/d3c. gpg 
http:// gateway. glop.me/ipfs/Qmao 1 2d6tWh 1 5b A5mU YQ 1 pcoT aiMc yb85SNyzrsS25 wpFa/eb7 . gpg 

>GPG keyrings: 

>7b42129c959b7db85688c5c686cl7eabdal0156138d96fb738fb8f0513dl34af 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1)2016-11-11 17:29:06 

>2593dbef02eeb4c7528773b0bdf0a4aba35ae3471bl07dee49886f8fe894flf0 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1)2016-10-31 19:41:29 

>17 a65dac7d4 1 1 e6 1 5 1 63 1 025c3b9ab22cf87d6dd4cad67 a097903 1 52dab4ab93 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1)2016-10-1120:28:11 

> 1 5dde0ff8e9e2 1 3ed20acdb01 e3c58faad749 1 c6f3a93cdc54dba055b45b737 1 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1) 2016-07-27 13:21:06 


[hide] 

»494cbb698ea3749254 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <af1b1 1480313746@web.oniichan.onion> 
Date: Mon Nov 28 06:15:46 201 6 




heads. zipDownload nov9.zipDownload 

tech.zip 


[hide] 

»0cdd539ebe75d7a72c [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <791 cdl 48031 7370@web.oniichan.onion> 
Date: Mon Nov 28 07:16:10 2016 


»28ele51d71 

Interesting. So this only seals the cemented idea that IP & DNS are a no-no (IANA&ICANN). I'd even go as far to say globalized 
domains are bad. Thanks Cubanos. 

»523e4b0fb2 

Thread backup, archive if you must. 


[hide] 

»ff3e7058e68eb8f933 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <588301 480345546@web.oniichan.onion> 
Date: Mon Nov 28 1 5:05:46 201 6 


>>88831 aea8 

Trips confirm. 


[hide] 

6 

»003680dabd4bccefc0 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <6c5571480345667@web.oniichan.onion> 
Date: Mon Nov 28 1 5:07:47 201 6 


>>88831 aea87 
Trips confirm! 


[hide] 

3 

»73f68b582d598d4d5e [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <1 7b271 48034741 2@2hu.tld> 
Date: Mon Nov 28 15:36:52 2016 


»a62a9230ff4c 15005b 
what does this prove? 


[hide] 

3 

»ff99070ed1 4c206f85 [Replvl 
Subject: None 
Name: Shasta 

MessagelD: <c34521480356357@2hu.tld> 
Date: Mon Nov 28 1 8:05:57 201 6 


438498967600 -> I'm back on Tox when you get a chance to log back in. I got questions about the new code - jean3, jean3_8bit and 
those pgp keys found up thread. 


[hide] 

6 

»ceb5303ef297663d2e [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <ecf861 480372831 @chan> 
Date: Mon Nov 28 22:40:31 201 6 


Some things I noticed this afternoon: 

endchan now has IDs 

I'm blocked on endchan 

Bitmessage deleted all my identities 

My phone was disconnected 

Beamstat seems to not be updating properly 



[hide] 

»34c9f05091e92bec83 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <e1e361480374633@web.oniichan.onion> 
Date: Mon Nov 28 23:10:33 2016 


>endchan now has IDs 

Only on /pol/. Other boards don't. Ask the board owner, iirc, odilintime was working on something, why the site is being updated as 
we speak. Contact him on irc.rizon.net/#endchan if you need prove. 

>I'm blocked on endchan 
above. 

>Bitmessage deleted all my identities 

Which node? Also, IIRC, you can self-delete them. 

>My phone was disconnected 
Why do you even have a phone? 

>Beamstat seems to not be updating properly 
can't say shit about it. 


[hide] 

6 

»91 502ac378dea7f1 67 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <b5541 1480376325@web.oniichan.onion> 
Date: Mon Nov 28 23:38:45 201 6 


Made account using lOminute mail, with a temporary user and password. Now only SnakeDude (pays the bills), OdiliTime 
(dev/sysadmin), Balrog, and global volunteers should have any access. YW. 


s6424n4x4bsmqs27.onion/POLAK/catalog.html 


[hide] 

»355ea9047367f4e0d0 [Reply! 

Subject: hi /pol/ 

Name: Anonymous 

MessagelD: <1b6ae1480377375@web.oniichan.onion> 
Date: Mon Nov 28 23:56:1 5 201 6 


[insert text] 


[hide] 

»327f271355d91 46844 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <ff9931480382259@web.oniichan.onion> 
Date: Tue Nov 29 01 :1 7:39 201 6 



Was dissapointed in the antics of those that raided endchan. Spamming until they bloked torposting.I appreciate the backup here. 


[hide] 

6 

»4e1 af87580f256efa5 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <a49c71480382492@web.oniichan.onion> 
Date: Tue Nov 29 01 :21 :32 201 6 


»34c9f05091 

»91502ac378 

»327f271355 


Logless BM bunker 

http://gateway.glop.me/ipfs/QmSLGxufdzkNBMGqglNwUuaCrcethPavN3iPzNYFtSDEkK/ffbbd7d918a09e876a06820498ec9e0c.ip 

g 

Use the text in this image, generate its SHA256 hash value. 

Add Chan -> Create a new chan -> chan name: [hash] 


[hide] 

»91 27c42278e047fadc [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <c58c91 4803961 08@web.oniichan.onion> 
Date: Tue Nov 29 05:08:28 201 6 


»5257babec8 

>anonlobo 

this guy is not responding 


[hide] 

6 

»c71 8bad81 47621 2822 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <293281 4803971 87@chan> 
Date: Tue Nov 29 05:26:27 201 6 


»ff99070edl 
You're not answering. 


[hide] 

6 

»8c2f4c7e35b3e7c9ed [Reply] 
Subject: None 
Name: Anonymous 



MessagelD: <bea091 480402670@web.oniichan.onion> 
Date: Tue Nov 29 06:57:50 201 6 


»9127c42278 

»c718bad814 

This is why I don't depend on anybody for leaks. 


[hide] 

»3c609880801 OedOdeO [Reolvl 
Subject: None 
Name: Anonymous 

MessagelD: <f384d1 4804051 1 1 @web.oniichan.onion> 
Date: Tue Nov 29 07:38:31 201 6 


»8c2f4c7e35 

this is why the keys are not out 


[hide] 

i 

»07fe5e24f5ca5a1 224 [Reolvl 
Subject: None 
Name: Anonymous 

MessagelD: <dbf4a1 480406789@web.oniichan.onion> 
Date: Tue Nov 29 08:06:29 201 6 


»3c60988080 

Let's get a real bunker going for fucks sake 


[hide] 

6 

»f3bba66f54e1 fObOOO [Reolvl 
Subject: None 
Name: Anonymous 

MessagelD: <2c88d1480408606@chan> 
Date: Tue Nov 29 08:36:46 201 6 


»e5b3b010e0 

http://gatewav.glop.me/ipfs/OmSYglTfsV7vKW3hzQRy9qxMSDUgztka5vVu91S9sFVeuM/code-fixed.7z 


[hide] 

6 

»1da98069049c2d71c4 [Reolvl 
Subject: None 
Name: Anonymous 

MessagelD: <9050e1 48040961 9@chan> 
Date: Tue Nov 29 08:53:39 201 6 


»07fe5e24f5 

Just set one up. If you want the link let me know so we can figure out a way to pass it on. 



[hide] 

6 

»3b59b1 acbl 1 ac24e4a [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <e2e871 48041 0659@web.oniichan.onion> 
Date: Tue Nov 29 09:1 0:59 201 6 


»327f27 1355 

SOOOO, went back for fun on those 2 threads, and the posts were deleted by: 

>Anonymous Board volunteer 11/29/2016 (Tue) 08:24:49 Id: 0de6c2 [Preview] No. 23993 del 
Ask Odilitime to confirm. At this point, I fucking don't care. 


[hide] 

»df26eb93b19d025640 [Repivl 
Subject: None 
Name: Anonymous 

MessagelD: <71 5831 48041 0869@web.oniichan.onion> 
Date: Tue Nov 29 09:1 4:29 201 6 


Evidence can even be seen left over by the link that did exist as a reply: 
s6424n4x4bsmqs27. onion/pol/res/22737. html#239 10 


[hide] 

§ 

»8c2a3d37b709f0c02e [Repivl 
Subject: None 
Name: Anonymous 

MessagelD: <c91c61 48041 2487@web.oniichan.onion> 
Date: Tue Nov 29 09:41 :27 201 6 



»9127c42278e047fadc 

>When i said monday I meant last monday and someone did come by other than anonlobo. 
I really have no idea wtf anonlobo is doing he was talking quite frequently before Sunday. 



You know the logless BM bunker ill send a message saying Prum in it so you can PM me about this because my router can't handle 
idling on i2p. (going to post an image here for you to crack in the mean time (just incase I never get to BM) fucking bitmessage isn’t 
making any connections for me today) 

But really setup dark hype peers we are pushing for this later because it doesn't require the real internet. 


[hide] 

# 

»f01 75b73a2d836cfe0 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <2089d1 48041 3299@web.oniichan.onion> 
Date: Tue Nov 29 09:54:59 201 6 



»9127c42278e047fadc 

>When i said monday I meant last monday and someone did come by other than anonlobo. 
I really have no idea wtf anonlobo is doing he was talking quite frequently before Sunday. 


You know the logless BM bunker ill send a message saying Prum in it so you can PM me about this because my router can't handle 
idling on i2p. (going to post an image here for you to crack in the mean time (just incase I never get to BM) fucking bitmessage isn’t 
making any connections for me today) 


But really setup dark hype peers we are pushing for this later because it doesn't require the real internet. 

>If a bunch of double posts come in it's because psi is lazy 


[hide] 

6 

»3800083c23d94d86c5 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <4e0ae1480422283@chan> 
Date: Tue Nov 29 1 2:24:43 201 6 


why do i see the same reply twice 

»f0175b73a2d836cfe0 

»8c2a3d37b709f0c02e 


[hide] 



i 

»d4f781e92431d32871 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <acd0a1480424238@web.oniichan.onion> 
Date: Tue Nov 29 1 2:57:1 8 201 6 


»3800083c23d94d86c5 

>"If a bunch of double posts come in it's because psi is lazy" 

Good question now go ask psi to fix it. 

Also did you get my PMs on BM yet? 


[hide] 

»4fec9e4744b15a9051 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <f062e1 480426957@2hu.tld> 
Date: Tue Nov 29 1 3:42:37 201 6 


»3800083c23 
they posted twice 


[hide] 

>>985471 2afd70408b7b [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <a841f1480434232@chan> 
Date: Tue Nov 29 1 5:43:52 201 6 


»d4f781e924 
Yeah. Thanks. 


[hide] 

3 

»6369e43c3325e173c6 [Replvl 
Subject: None 
Name: shasta 

MessagelD: <c1 7e61 480436743@2hu.tld> 
Date: Tue Nov 29 1 6:25:43 201 6 


»c718bad814 

Sorry I was away a lot longer than I thought I would have been yesterday. I'm on but doing IRL work. I'll be on until about 1 am UTC 


[hide] 

»b67db96922391 a42ab [Reply! 

Subject: None 
Name: shasta 

MessagelD: <3b45f1480448998@2hu.tld> 


Date: Tue Nov 29 1 9:49:58 201 6 


»e5b3b010e0 

ok, I've got the DB starting to parse the block info. It looks like it'll need to run at least a few hours - maybe all night. 

>Once it's done do we want to host the out.db file somewhere? 

>IPFS? 

>and How to get it there? 

I'm not currently running IPFS anywhere. It will be big if run against the entire block chain; which is what I'm doing. 

>Next - what to look for within the DB relationship wise? 

>Do we want to host a simple site to go through the info? 

>Start running the wallet. py or tird script against the DB? 


[hide] 

6 

»c25c039d8a81 ae9764 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <b5e621 480467424@chan> 
Date: Wed Nov 30 00:57:04 201 6 


Can you scan these addresses; 

lKEyVEndor3p6c3NL2UiVhscXPZKb3DfYl 

lKEYVENdoRGdbgzXUW8eJVzNp5yoTGG7hg 

3CaaFJF39T9TWiNtCKTnU79A3NvGeWKdqL 

lNquFlc4AuKx9YJtP9SsjGqhazfa72yPBM 


[hide] 

6 

»7557e708baaf381 1 84 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <f963d1 480468367@chan> 
Date: Wed Nov 30 01 :1 2:47 201 6 


»e5b3b010e0 

http://gatewav.glop.me/ipfs/QmVhnQaWprlE99S6R7ZYsRsK9TB5biPigoR2104Bg5rwzG/db-fixed-for-the-last-fucking-time.7z 


[hide] 

»52d0d1 55ff70b84576 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <ae9fd1 480480581 @ucavviu7wl6azuw7.onion> 
Date: Wed Nov 30 04:36:21 201 6 


Please note that only UNSPENT transactions will contain data. 

If a transaction is SPENT, it means that someone managed to generate a Private Key corresponding to an address that is a 
representation of that block of data (THIS BORDERS ON IMPOSSIBLE). 

Jean's script, last I checked, does not do this. 



MODIFY THE SCRIPT TO ONLY INCLUDE UNSPENT TRANSACTIONS. 


[hide] 

6 

»7770f3c474871 cbf7b [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <8f7871480529594@chan> 
Date: Wed Nov 30 18:13:14 2016 


»8c2a3d37b7 

BM is kill. Where else can we talk? 


[hide] 

3 

»4667e5d76a63f50547 [Replvl 
Subject: None 
Name: Shasta 

MessagelD: <c041d1 48053791 9@2hu.tld> 
Date: Wed Nov 30 20:31 :59 201 6 


can someone take a look at DROID 

>http://www. national archives.gov.uk/information-management/manage-information/preserving -digital-records/droid/ 

and see if it would be easy to modify the wallet code to use this instead of TrID? DROID was developed by the National Archives to 
id digital file types and uses the PRONOM technical registry for sig definitions. 

I personally am just being lazy in not rolling up a Linux VM to run the TrID x86 version. 


[hide] 

6 

»b6281 01 364dcb9b1 2d [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <dff281 480538531 @web.oniichan.onion> 
Date: Wed Nov 30 20:42:1 1 201 6 


»4667e5d76a 

>. gov.co.uk 

I wouldn't even open that in tor browser. 


[hide] 

6 

»abc8795b1 5cb87a594 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <451 3b1 48053991 4@chan> 
Date: Wed Nov 30 21 :05:14 201 6 


»52d0dl55ff 
like this? 

lazy version of this 



http://gatewav.glop.me/ipfs/Qma47U9fvVT2DzV2qRSVMXtt78rEBfEA1191MSwKdDzFBG/newiean3.py 


[hide] 

3 

»fc1 ca202725fccc08f [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <62bed1480550786@2hu.tld> 
Date: Thu Dec 1 00:06:26 2016 


71 Ut'k171^tc^bSafi 5SlZr3LMfcT>3<hf ?iaZ* Kib3H1^>V-«i%fl731«61 
K12f.eC JWB?8 l*Ui b!i«tLHM0k*k-244 1 7a , Jb€0 , Jl Z4Br« J 
a l'V3L IBlbc f f *c f ?.i?A«'ylr , u'x'>/f ('kr**t 


HB5XMI_mzFVi8AU6mfBsbifRoD4miY36vnew tx list.txt 

>>24216 

interesting after running newjean3 for an hour or more on the WL wallet I got this: 

Traceback (most recent call last): 

File "newjean3.py", line 95, in <module> 
decoded_data = txdecode(str(lll)) 

File "newjean3.py", line 36, in txdecode 

data = urllib2.urlopen(" https://blockchain.info/tx/"+transaction+"?show adv=true" :) 

File "/Library/Frameworks/Python. framework/Versions/2. 7/lib/python2.7/urllib2.py", line 126, inurlopen 
return _opener.open(url, data, timeout) 

File "/Library/Frameworks/Python. framework/Versions/2. 7/lib/python2.7/urllib2.py", line 406, in open 
response = meth(req, response) 

File "/Library/Frameworks/Python. framework/Versions/2. 7/lib/python2.7/urllib2.py", line 519, in http_response 
’http', request, response, code, msg, hdrs) 

File "/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 444, in error 
return self._call_chain(*args) 

File "/Library/Frameworks/Python. framework/Versions/2. 7/lib/python2.7/urllib2.py", line 378, in _call_chain 
result = func(*args) 

File "/Library/Frameworks/Python. framework/Versions/2. 7/lib/python2.7/urllib2.py", line 527, in http_error_default 
raise HTTPError(req.get_full_url(), code, msg, hdrs, fp) 

urllib2 . HTTPError: HTTP Error 502: Bad Gateway 

I know it's not my ISP because I was streaming news at the same time this 502 error hit. 

attached is the TX list file. The last TX processed is from July, 2015. So all the TX in the list are "unspent" TX from WL and most 

likely have data - Am I correct? 


[hide] 

6 

»5fbfc71474a447e43e [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <54d71 1480551 136@web.oniichan.onion> 



Date: Thu Dec 1 00:12:16 2016 


»fclca20272 

>macos 

there's your problem 


[hide] 

»7e1e5fe2f29eed6875 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <b2b971 480551 504@web.oniichan.onion> 
Date: Thu Dec 1 00:18:24 2016 


Does this page look like it was censored? 

https://blockchain.info/block/000000000000000001f4840a9cc93cb949697f97969el984f69f789385d00cd7 


[hide] 

»202732f97f3d670365 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <06b031480557457@web.oniichan.onion> 
Date: Thu Dec 1 01 :57:37 201 6 


Download * zeroed. png 

»7ele5fe2f2 


[hide] 

»9d6b0c1 379d61 70df0 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <0b4ac1480560268@chan> 
Date: Thu Dec 1 02:44:28 2016 





»7ele5fe2f2 

»202732f97f 

>>24222 

>>24230 

It's real. They flat out deleted a block. 

https://blockchain.info/rawblock/000000000000000001f4840a9cc93cb949697f97969el984f69f789385d00cd7 


{ 

M hash":"000000000000000001f4840a9cc93cb949697f97969el984f69f789385d00cd7", 

"ver":536870912, 

"prev_block" : "000000000000000002670ad664a90b86 1 7c 1 5e9902f3600 1 6bf334d6ec9e 1 c9f ' , 
"mrkl_root":"001baa524eceblb2561adlb9acflf62d39671e52a6e217965798893f8cf70014", 

"time" : 1480549 1 74, 

"bits":402908884, 

"fee":0, 

"nonce":3679241 102, 

"n_tx":l, 

"size":238, 

"blockjndex": 1171372, 

"main_chain":true, 

"height" :44 1339, 

"received_time" : 1480549 1 74, 

"relay ed_by" :"178.62.203.185", 

"tx":[ 

{ 

"lock_time":0, 

"ver":l, 

"size": 157, 

"inputs" :[ 

{ 

"sequence":4294967295, 

"Script":"03fbbb060436633f582f4254432e434f4d2ffabe6d6de98fc4fc3e8afe90f534c7af4231c22662c9111753ff7b433703142fl 17720 
620 10000000000000002b6789c447 aOOOOOOOOOOOO" 

} 

], 

"time": 1480549174, 

"tx_index" : 194265303, 

"vin_sz":l, 

M hash":"001baa524eceblb2561adlb9acflf62d39671e52a6e217965798893f8cf70014", 

"vout_sz":l, 

"relayed_by":" 178.62.203. 185", 

"out":[ 

{ 

"spent":false, 

"txjndex": 194265303, 

"type":0, 

"addr" : "3NA8hsjfdg VkmmVS9moHmkZs VCoLxUkvvv" , 

"value": 1250000000, 

"n":0, 

"Script":"a914e083685al097celea9e91987ab9e94eae33d8al387" 

} 

] 

}] 

} 


[hide] 



s 

»cb3bb7c770f61 Ofl 8f [Repivl 
Subject: None 
Name: Anonymous 

MessagelD: <c805b1 48061 3304@chan> 
Date: Thu Dec 1 17:28:24 2016 


Remember -LOVEINT" - Ihe .legal u'NSAG 
pracbct o4 spying on p«op* you Turns 
out prosecutors have been doing the same 
thng 


I h ,V4I y*M£C»£M 
m 

Download loveint.pnq 

https://twitter.com/Snowden/status/803640548464594944 
>Edward Snowden Verified account 
>@ Snowden 

>Edward Snowden Retweeted NYT Metro Desk 

>Remember "LOVEINT" — the illegal @NSAGov practice of spying on people you like? Turns >out prosecutors have been doing the 
same thing. 

>8:43 AM -29 Nov 2016 

https://twitter.com/NYTMetro/status/8034525530108Q2689 

>NYT Metro Desk Verified account 

>@NYTMetro 

>Brooklyn prosecutor is accused of using illegal wiretap to spy on love interest 
>8:16 PM -28 Nov 2016 

>And this is where the DoJ right now is demanding the FBI to stop it's investigation, thus you understand the friction. 

>Note that most SVU agents _are_ former convicts. The questions that everyone should be asking: are these former pedophiles using 
their positions to continue their escapades? 

>Could they _abuse_ their current positions with all the new tools the NSA granted them? 

>If you are a historian, you should know the answer. And a quick investigation on LOVEINT will dossies everything. 

>Sun Nov 6 11:19:29 2016 

[spoilerjRemember Assange's latest ’charges'[/spoiler] 


[hide] 

6 

»aeba2369d2b01 30443 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <88bc21 4806221 18@chan> 
Date: Thu Dec 1 19:55:18 2016 


jean3.py + ASCII text detection 

http://gatewav.glop.me/ipfs/Omeiv5XxrcZTanNuLlUCegJMZZfzsVh4fF4x2YGQBUKbY3/iean3.py 

Patched newjean3.py (only reads data from unspent addresses) 

It also detects ASCII text now. 

http://gatewav.glop.me/ipfs/OmXHcwhPK2nLKrBsdhFsZWOE6RFXTgr7iY9oo7QLR4TXU3/newiean3.pv 


[hide] 

6 

»af1 edd0ff060451 7be [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <5951 91 480641 01 8@chan> 
Date: Fri Dec 2 01:10:18 2016 


>Is page 8 about m_cetera? 

https://wikileaks.org/IMG/pdf/Assange-WikiLeaks-Enemy-USAF-FOI.pdf 


[hide] 

6 

»07266cfa9e1 35a2f38 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <174281 480642594@chan> 
Date: Fri Dec 2 01 :36:34 201 6 


• ■ >•(* . : 

I too 14 wit r ini *nj rr-AiUhle tf.li there. aII tk '‘text" 4 a Ia contain* LkirAi.tr 
r yikfcerlsh 

rijtkiii 2. 7 ic rift (Unu only) to prwhce this list Is At Ur ml of Ur y 
Hoc 


file header dump 


[hide] 

3 

»bd6996fbbbd067cda9 [Replvl 
Subject: None 
Name: shasta 

MessagelD: <ce53d1480693083@2hu.tld> 
Date: Fri Dec 2 15:38:03 2016 


»07266cfa9e 

I can't find/see these characters in the script that cause this error. 

>File "blockscan.py", line 13 

>SyntaxError: Non-ASCII character '\xe2' in file blockscan.py on line 13, but no encoding declared 
Adding a ’#coding = o' doesn't fix the error either. 

Is there a way you can push this code to a pastebin? 

Also <438498967600> not sure if you changed Tox ID, but haven't seen you in 2 days... My Tox/Tor have been acting up yesterday 
and today so that might be the issue. Need some help with the codes if we can hook up. 



[hide] 

»4aed5b4dd0a672a9b8 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <507a71480705008@2hu.tld> 
Date: Fri Dec 2 18:56:48 2016 



blocks 383001-383100: 


any line that has pgp in it (97 total) and broken out in secret and sub 


[hide] 

»7827624f00a45ac743 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <4e8c01480705342@2hu.tld> 



Date: Fri Dec 2 19:02:22 2016 


Lie m vl4eo (1/1) 201b-il-Z9 6B:2 5:24 

fcbrfivUc iaZaMj€BS^0Or^«r^efc«teMbl^ffy>7*Z-Mfaac«cK2TJbd8t3jfMk 100 ft- C.CH> < 
Mia CIL bitmp 12000/1 J 281b II 10 19 3 


Downloadl 

all the unspent TX from WL wallet for 2016 
3 - GPG keyrings: 


10-12-16 - TX = 82671d766bf76e3779ffd42493c71979bb8caefl5f2a9642dcb0b7389ac0027d 

10- 31-16 - TX = 8dalfblb0e9fb4d01e0a8cbe35781e79fe6bcc0c071cc9d7aa6a9a595e44e43e 

11- 11-16 - TX = 7b42129c959b7db85688c5c686cl7eabdal0156138d96fb738fb8f0513dl34af 


l l HB5XMLmzFVi8AU6mfBsbifRoD4miY36vnew file tx list.txt 


[hide] 

»a2c3d962668682531 7 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <df2dc1 48071 8395@2hu.tld> 
Date: Fri Dec 2 22:39:55 2016 


Download 


| TMnNkCCMIOOM 


©114218070441 ©ZW.U401 tr+ r#acv on 

h*r 0 during h#* tantrum do+t 


mcetera2.jpg 


»8c52ab606f 

what are your proofs that @m_cetera contrails @wikileaks twitter accounts? 
So far 1 found no proof of that anywhere: 

@fINAL_C0UNTD0WN https://twitter.com/flNAL COUNTDOWN 



claims that 

@m_cetera https://twitter.com/rn cetera 
runs @wikileaks twitter account 

So far he didnt provide any proof (timing and tantrum doesnt cont much), his last tweets mentions some session cookies IDs, for 
which I am pretty sure he doesnt have access too. Even if he somehow saw m-ceteras or wikileaks cookies, how can he know twitter 
session cookie ids for certain users? 


[hide] 

: 2 > 

»dde4a81 5f238ad6bfe [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <24a241 48071 9621 @2hu.tld> 
Date: Fri Dec 2 23:00:21 2016 



»a2c3d96266 
I forgot first pic. 


https://twitter.com/flNAL CQUNTDQWN/status/80444825 1235569664 

>the second one, if you missed it, was the session ID. You know, the cookie you use to keep you logged into Twitter. 

It think that by "the second one'" he refers to some tweet, but he didnt link anything 

Even if he somehow saw @m_cetera session cookies, you cant just get users ID from them. I havent looked deep into twitter cookies 
but I assume cookie id or value isnt just base64 of username. I think @flNAL_COUNTDOWN just throw our some technical jargon 
thinking that readers have no idea how cookies work. 

Did anyone saw that alleged second tweet? 

Did anyone saw any other reasons why one would think she runs @wikileaks? 


[hide] 




& 

»7a2e42eaf6a458ce9f [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <ce5671480720847@web.oniichan.onion> 
Date: Fri Dec 2 23:20:47 201 6 


»4aed5b4dd0 

»7827624f00 

You should try to extract the valid packets from those pgp files. 
http://superuser.com/questions/801526/how-can-i-fix-a-corrupted-pgp-file 


[hide] 

»932457d7f431d3cca1 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <6739a1 480721 141 @chan> 
Date: Fri Dec 2 23:25:41 2016 


»bd6996fbbb 
dont use tox 


[hide] 

6 

»497f007f2b2bb1 695a [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <aba661480725022@chan> 
Date: Sat Dec 3 00:30:22 201 6 



Download packets. ov 

»7a2e42eaf6 

»7827624f00 

»4aed5b4dd0 

»07266cfa9e 

Script to print all valid packets in a gpg file: 

http://gatewav.glop.me/ipfs/QmYLb88V3v9Bql5E6eX72XEwuTpqF7JEU3DboGFPvSdUtz/packets.py 

Usage: 



python packets.py 

(prints all valid packets in all gpg files in that directory) 


[hide] 

6 

»676c0028c04a762e30 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <8c3361480725688@chan> 
Date: Sat Dec 3 00:41 :28 201 6 


»497f007f2b 
then do 
»7a2e42eaf6 


[hide] 

»0a5ab1 1 b23efe8efd6 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <e83a31480890474@web.oniichan.onion> 
Date: Sun Dec 4 22:27:54 201 6 


Has anyone tried searching for the Wikileaks public keys in the blockchain? 
https://wikileaks.Org/index.en.html#submit wlkey 
http://pgp.mit.edu/pks/lookup?search=Qxl 1015F80&op=index 
https://sks-kevservers.net/pks/lookup?op=vindex&search=wikileaks&fingerprint=on 


[hide] 

»a286d61 6ac2b525a41 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <876291 480893743@web.oniichan.onion> 
Date: Sun Dec 4 23:22:23 201 6 



>Dumping the output of 'gpg -list-packets' for all that don’t return with no 'valid OpenPGP data found' 
>There's a couple of 'gpg: onepass_sig with unknown version’ 

>Might be a good idea to also run 'gpg — with-fingerprint' 

>http://gate way. glop. me/ipfs/QmaRiuxiadz6uE8q9tvxuJ7jLUDYiBJ4fVWcCMHHYMr7Qs/packets.txt 



>Has anyone tried searching for the Wikileaks public keys in the blockchain? 
>https://wikileaks.org/index.en.html#submit_wlkey 
>http://pgp.mit.edu/pks/lookup?search=Oxl 1015F80&op=index 
>https://sks-keyservers.net/pks/lookup?op=vindex&search=wikileaks&fmgerprint=on 


[hide] 

»d5b1 e0707683beb42e [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <ccc6e1480909623@chan> 
Date: Mon Dec 5 03:47:03 2016 


>sql 

http://dumps.webbtc.com/bitcoin/ 


[hide] 
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»ac0ba96e99d18448d0 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <9b02d1480958959@web.oniichan.onion> 
Date: Mon Dec 5 17:29:19 2016 


»bd6996fbbb 
you're never online 


[hide] 

::> 

»0281 1c9b20407ddafe [Replvl 
Subject: None 
Name: shasta 

MessagelD: <af4601480967797@2hu.tld> 
Date: Mon Dec 5 19:56:37 2016 


»ac0ba96e99 

sent you a message at that ID from my new ID 

BDF829A0754752F9249CAAF7752604A386D9FFC1091341285EB83C60DD5497043DC7563C3E58 


[hide] 
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»7ab25acda723ed97ac [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <285271 480974667@chan> 
Date: Mon Dec 5 21 :51 :07 201 6 


https://blockchain.info/tx/3dfd6b96e0583al7b34dcd3a4dcb021949ece3140b7al918c4de07cea32d43647show adv=true 

> 1 HB 5XMLmzF Vj 8 ALj 6mfB sbifRoD4mi Y36v (WikiLeaks ) (0.00008224 BTC - Output) 
>lHB5XMLmzFVj8ALj6mfBsbifRoD4miY36v (WikiLeaks ) (0.000006 BTC - Output) 
>lHB5XMLmzFVj8ALj6mfBsbifRoD4miY36v (WikiLeaks ) (0.085483 BTC - Output) 

> 1 HB 5XMLmzF Vj 8 ALj 6mfB sbifRoD4mi Y36v (WikiLeaks ) (4.911 BTC - Output) 



>lHB5XMLmzFVj8ALj6mfBsbifRoD4miY36v (WikiLeaks ) (0.0050644 BTC - Output) 

>199111 8e2ccb0b8e0dl4c560ce6092c5a4a94c74 

https://blockchain.info/tx/eaa6a30c4145eca619621ea0b644e9e0f953c5465696382e3b4f0ba8917416ce7show adv=true 
>199111 8e2ccb0b8e0d 14c560ce6092c5a4a94c74 

https://blockchain.info/address/13LBgLZ24X55mr8LqKddy9DusJtbal7NCC 
>2016-11-20 21:43:32 

http://www.mgff99.eom/s/1991 1 18e2ccb0b8e0dl4c560ce6092c5a4a94c74 

https://www.sec.gov/Archives/edgar/data/886982/000119312515171272/0Q01193125-15-171272.txt 


»1 a47864d82f2ec578c [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <0386c1480975224@chan> 
Date: Mon Dec 5 22:00:24 2016 


»7ab25acda7 

fc722ce39094500690a4d4676fe475520d6a0af590336b73202010ca260bbd20 
100.0% (.PGC) PGN (Portable Gaming Notation) Compressed format (1000/1) 


»c1 293a82454c3d56d1 [Reply] 

Subject: None 
Name: shasta 

MessagelD: <f4fdf1480983460@2hu.tld> 
Date: Tue Dec 6 00:17:40 2016 



raw data from that TX. 

I think the PGN is a false positive by TrID. 


[hide] 




[hide] 



[hide] 
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»eda41d50cf732e7dc1 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <152f61 4809881 37@web.oniichan.onion> 



Date: T ue Dec 6 01 :35:37 201 6 



>==NORMIES PAY ATTENTION== 

>Stop relying on scripts and crappy software. The steps to find every single file in the blockchain have been posted here numerous 
times >>22945. A lot of you have been staring at the data for over a week now. Here's another attempt at being even more clear: 

>Every single file has a hex file header. You can see a list of some here: http://www.garykessler.net/library/file_sigs.html and here 
http://file -extension. net/seeker/seeker.cgi?ext=&filetype_AND=pgp&filetype_OR=&filetype_NOT=&seek=Seek%21 However, this 
is not the entire list. The lists 'trid' and 'file' use are not complete either. Yet, you don't even need these lists. You can simply look at 
any file of a type you are interested in finding. Yes, any. Open it with a hex editor and look at the file header. If you want to find a zip 
file, just download any zipfile, look at the header with a hex editor and then search for it. The headers are not going to always be at the 
beginning of the file. Scan the entire file for headers and footers. 

>Yes footers. Files also have footers! You can find the ending of a file by looking for its hex footer. Here are some examples: 
http://www.datadoctor.biz/data_recovery_programming_book_chapterl4-page2.html Again, this is not a complete list. If you want to 
see what the footer of a file looks like, open one with a hex editor. 

>JUST TO MAKE SURE WE’RE BEING COMPLETELY CLEAR HERE: 

>If you find 37 7A BC AF 27 1C, you just found the beginning of a 7-zip file. If you find 89 50 4E 47 OD OA 1 A OA, you just found 
the beginning of a PNG file. These are just examples. There are a lot more file headers to look out for. 

>If you find 50 4B 05 06 00, you just found the end of a zip file. If you find 25 25 45 4F 46 you just found the end of a pdf file. There 
are more footers and you can make your own list by looking at different files. These are just examples. There are a lot more file 
footers to look out for. 

>Stop looking at only the beginning of decoded data, trid and file both do this (and badly). It can be anywhere in the transaction! 
>Don't rely on software to do this. Simply search for those hex values in the decoded data! 


[hide] 

»5c8a5c778759bcc013 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <06ee81 481 0551 1 1 @web.oniichan.onion> 
Date: Tue Dec 6 20:1 1:51 2016 



For publishers for example, so that, as an example we are starting to use Bitcoin, Wikileaks, stuffing our, cryptographic keys of stuff 
that we publish, so, "'we prove that we have published stuff at a particular time by stuffing it in Bitcoin, in the blockchain, and then, if 
someone were to come and try to modify the material that we have published, to take a particular part, that would be detectable'". 
-Julian Assange, Nantucket Project, Sept 28 2104 



'"Wikileaks needs to change in order to survive and thrive through the next few months'"... If necessary of course, '"if I'm not able to 
continue'" or the Ecuadorian people are unreasonably blamed for Wikileaks' publications, "'I will have to resign as editor, but our 
publications will continue'". The part of the necessary defense of Wikileaks, we have engaged in a new project to recruit people across 

the world to defend our publication - ’"and we’ll give details of that as the weeks go by we will issue guidelines about how you can 

promote Wikileaks publications without censorship.’" 

- Julian Assange, Wikileaks 10 Years Press Conference, Oct 4th 2016 


[hide] 

»54b9a5c286c493f733 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <51f671481062582@chan> 
Date: Tue Dec 6 22:16:22 2016 


use wikileaks' own files to get a nice header list 
https://file.wikileaks.org/file/ 

Some headers: 

AVI 52 49 46 46 

Torrent 64 38 3A 61 6E 6E 6F 75 6E 63 65 

PDF 25 50 44 46 2D312E 

Zip 50 4B 03 04 14 

7zip 37 7 A BC AF 27 1C 

Some footers: 

7zip 00 00 00 17 06 

You can find this in cablegate.7z you can also make a file in your computer and search for this near the end. footers are not always at 
the end of the file, they are usually towards the end. 

Zip 50 4B 05 06 00 
PDF 25 25 45 4F 46 

dont trust any headers/footers you find online, verify them yourself by using a hex editor, you can use hex editors on windows, if you 
want to find PGP/GPG files for example, make a couple of them on different computers and then look at them with a hex editor, you 
will see the headers at the beginning, footers are usually near the end. use 7zip as an example, make a 7zip file on your computer and 
compare it to cablegate.7z, you will find the footer near the end. see what file types wikileaks commonly uses, get the info for them, 
once you have a nice list of these, you will easily find all files of this type on the blockchain. 


[hide] 
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»b97464931 fee81 ee8a [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <a8cc41481086263@chan> 
Date: Wed Dec 7 04:51 :03 201 6 


https://en.rn. wikipedia.org/wiki/Rubberhose %28file system%29 

>The project was originally named Rubberhose, as it was designed to be resistant to attacks by people willing to use torture on those 
who knew the encryption keys. This is a reference to the rubber -hose cryptanalysis euphemism. 

>It was written in 1997-2000 by Julian Assange, Suelette Dreyfus, and Ralf Weinmann.[ 


[hide] 

»2a45d375df473f26b9 [Replvl 
Subject: None 
Name: shasta 

MessagelD: <f81 1 21 481 1 28247@2hu.tld> 



Date: Wed Dec 7 16:30:47 2016 


>>20366 thread is dead/locked. I have the entire thread archived locally as pdf and full html. 
Any decision on where to pick this up? Here? Back on end? 


[hide] 

»dc4801 1 98ac1 4973a6 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <69f421 481 130081 @web.oniichan.onion> 
Date: Wed Dec 7 1 7:01 :21 201 6 


did the endchan thread die? http://s6424n4x4bsmqs27.omon/pol/res/20366.html seems like it's locked... 


[hide] 
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»5586c0ac05cf64df23 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <896601 481 1 34331 @chan> 
Date: Wed Dec 7 1 8:1 2:1 1 201 6 


Ask the Board owner. Dunno if there’s another mod. 

And tell odilitime to implement board logs, like in vichan. .global says shit about board specific behavior. 


[hide] 

»29452da8e7d9c55be5 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <f42981 481 1 351 41 @chan> 
Date: Wed Dec 7 18:25:41 2016 


»2a45d375df 

We should continue here. Also here »91502ac378 
s6424n4x4bsmqs27.onion/POLAK/catalog.html 
Working on gajim+PGP+OTR for fastposting 


[hide] 
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»60bdba1 f7529fde1 74 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <444a01 481 1361 08@ucavviu7wl6azuw7.onion> 
Date: Wed Dec 7 1 8:41 :48 201 6 


»29452da8e7 

since I work, have to eat, and run, use jitsi 



IMHO, instant messaging is BAAAAAAD opsec. Why I stick to NNTP encrypted servers, or mix Mixminion IV. *Still hope for 
Freenet. 


[hide] 
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»0923fd0de1 b80a8bff [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <0491 fl 481 139894@chan> 
Date: Wed Dec 7 19:44:54 2016 



»60bdbalf75 
»29452da8e7 
»5586c0ac05 
»dc4801 198a 
»2a45d375df 

NEW ENDCHAN THREAD: 
http://s6424n4x4bsmqs27.omon/POLAK/res/15.html 

FAST POSTING: 

Download Gajim https://gaiim.org/ (or any Jabber client that supports OTR and a proxy option 
https://wikipedia.org/wiki/List of XMPP client software ) 

Download OTR plugin https://dev.gaiim.org/gaiim/gaiim-plugins/wikis/OffTheRecordPlugin https ://de v . gaj im. org/gaj im/gai im- 
plugins/tree/master/gotr (Or the plugin needed for your Jabber client) 

Create a GPG key (if using GPG for encryption and not OTR) 

Make account: 

Server: volatile. ch 
Advanced: 

Hostname: vola7ileiax4ueow. onion Port: 5222 

Make a new proxy option with manage to: 127.0.0.1 9050 (socks5) 

Preferences (for volatile account): 

Disable 'Allow client / OS information to be sent' 

Disable 'Allow local system time information to be sent' 

Disable 'Log encrypted chat session’ 

Disable ’Allow my idle time to be sent' 

Edit > Accounts > General (for volatile account): 

Disable 'Synchronize accounts status with global status' 

Disable 'Save conversation logs for all contacts' 


[hide] 

6 

»b8e1 6c7c97f0903488 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <f360d1 481 14541 3@web.oniichan.onion> 
Date: Wed Dec 7 21 :1 6:53 201 6 



»0923fd0del 
where on jabber is it? 


[hide] 

6 

»a5808f989feab1 6b66 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <025391481 148093@web.oniichan.onion> 
Date: Wed Dec 7 22:01 :33 201 6 


join chat room "ebin" on muc. volatile. ch for epik operations 


[hide] 

6 

»39690e700241ff46a7 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <ac4a91481 1 67331 @web.oniichan.onion> 
Date: Thu Dec 8 03:22:1 1 201 6 


»a5808f989f 

is it taken down already? won't connect 


[hide] 

»ca68bc2c469eb0927b [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <8e0d81481201275@web.oniichan.onion> 
Date: Thu Dec 8 12:47:55 2016 


»39690e7002 
it's an xmpp muc 


[hide] 

6 

»2cdbe931 ac3de8ee3f [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <1 a8b61 481 222644@chan> 
Date: Thu Dec 8 18:44:04 2016 



Download 


— 


— 


— 



screen. ona 


BLOCK 435250 

Link Anomaly Status Amount Size Time 

https://blockchain.info/tx/64abaf5ffac37f41c5alb8b52deb5a21c7400b2a4elf20433bb3120c6c36ae51 Unable to decode output 
address Unspent 0 288 2016-10-21 13:16:09 

https://blockchain.info/tx/3410d6264a83683ce785289eebdl7f7ccbl4b7b2abcee34ece534cflb75087c9 Unable to decode output 
address Unspent 0 269 2016-10-21 13:16:09 

https://blockchain.info/tx/26a78bfda83f5f6b6bae3957calaca31519436617902ea74220233b868b2a805 Unable to decode output 
address Unspent 0 256 2016-10-21 13:16:09 

https://blockchain.info/tx/6e412ca6112f0f0fl4680d83151033bal8Q35eb4b81387flf9ce38dOc6893af Unable to decode output 
address Unspent 0 242 2016-10-21 13:16:09 

https://blockchain.info/tx/5fbfe2dbc0965ccld74ecc06ale4a776d4303a40c8f716168ab6ad01a87794ea Unable to decode output 
address Unspent 0 242 2016-10-21 13:16:09 

https://blockchain.info/tx/a9dbcd57268b4b6d7eb40e09c5b5970f2c4d897bd3d47f83be658bfbc45580fl Unable to decode 

output address Unspent 0 275 2016-10-21 13:16:09 

https://blockchain.info/tx/17202c7ae9efec4dae73dbl45ea61delfae090fd57d667f318871de45d799bcl Unable to decode output 
address Unspent 0 275 2016-10-21 13:16:09 

https://blockchain.info/tx/0fb02f09d710737cdd4c0d47c50774a7allae548b972f071965935955al315b4 Unable to decode 

output address Unspent 0 648 2016-10-21 13:16:09 

https://blockchain.info/tx/944de0e90a70ca65640007d4b5de7619dd0874ad9a8cl709f500c54310ba2e7 Unable to decode 

output address Unspent 0 264 2016-10-21 13:16:09 

https://blockchain.info/tx/0c8e715dbla79a8020e8f292c08f20749dfb8b59e5048884f82c22ac3293a9a6 Unable to decode output 
address Unspent 0 265 2016-10-21 13:16:09 

https://blockchain.info/tx/l Id40e3c6el Ide924be7ec71af2d76cbdddd7a6359a6ea672787aca4ce25c5fb Unable to decode output 
address Unspent 0 237 2016-10-21 13:16:09 

https://blockchain.info/tx/2cd710205c0249eea43d0e589a6beabc9a9d488fc0c9c8e2497b48dfbf9e091 1 Unable to decode output 
address Unspent 0 237 2016-10-21 13:16:09 

https://blockchain.info/tx/82e7dafl9b24d4f3228dl4a88add9f7b401951d82181ed532f739cOclfa2022 Unable to decode output 
address Unspent 0 237 2016-10-21 13:16:09 

https://blockchain.info/tx/aa23347580cc98b47bd662ae418de250141f22b8649dcb79630e56bfc80ea445 Unable to decode 

output address Unspent 0 238 2016-10-21 13:16:09 

https://blockchain.info/tx/d295f447d25a3c8969el 10c9c6a34d92ad86eafa8083ee5dcd449acb369d287c Unable to decode output 
address Unspent 0 239 2016-10-21 13:16:09 

https://blockchain.info/tx/6ecf2b6d21312584c51550534729589cl95a4fe5970688384b3ea76477fd9afe Unable to decode output 
address Unspent 0 297 2016-10-21 13:16:09 

https://blockchain.info/tx/a071 Iaad3475b773f408779aa5aecc523e2c213cecb0f7a93d7d46fflcl36e 18 Unable to decode output 
address Unspent 0 296 2016-10-21 13:16:09 

https://blockchain.info/tx/59d41ca2325c74439a84c2a7eb46033fe213315e9el87cl6dc6a8cb702adffaf Unable to decode output 
address Unspent 0 296 2016-10-21 13:16:09 

https://blockchain.info/tx/18f6ae5323affldca6cf4fc4157fff5a990b37f0e3e43f762e9df5cadce08982 Unable to decode output 
address Unspent 0 296 2016-10-21 13:16:09 

https://blockchain.info/tx/884736546d806654781f4dl45b87e9e947aaf0f76d28e3c4fa399fe2d89a5c43 Unable to decode output 
address Unspent 0 264 2016-10-21 13:16:09 

https://blockchain.info/tx/74f9fcb4eld047278d46cbbba81331abcb2628ea9e250c9a960c002538c664d9 

https://blockchain.info/address/lL8WoLiiGiNvi3TXXW4nMZMwLpKZeV3gKf 

https://blockchain.info/tx-index/185992996 


[hide] 

6 

»7c4f8581ca08c34765 [Reply! 
Subject: None 


Name: Anonymous 

MessagelD: <6f1 5c1 481 2241 77@chan> 
Date: Thu Dec 8 19:09:37 2016 


NEW CODE: 

https://github.com/WikiLeaksFreedomForce 


[hide] 

»abb82e7b55ebf4abf7 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <fb80b1 481 224532@web.oniichan.onion> 
Date: Thu Dec 8 19:15:32 2016 


>Lets say it is byte 17. If an address is the only one with "00" at byte 17, it might mean "00". If another address has a "00" there, it is 
probably not byte 17. 

>So just have to collect up all the common addresses, see how many there are. 256? 65536? 

>That would be a big clue 


[hide] 

»50ed562f0d2dcd4dcb [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <4e7641481225855@chan> 
Date: Thu Dec 8 19:37:35 2016 



Download e091 1 .php 

FILE ASSEMBLY CODE: 

http://gatewav.glop.me/ipfs/OmVWJVbis7es6s7cDsRmt5WBHeioc4HztR4R74Lg8KBmhU/e091 1. php 


[hide] 

»203efa84a68ee02509 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <a00ac1 481 226507@chan> 



Date: Thu Dec 8 19:48:27 2016 



Download 435205block.zip 

http://gateway.glop.me/ipfs/QmOniYcDmRMoNCSkaNiwLaBZMFFT3vX8GmF25S9TdJfpRT/4352Q5block.zip 


[hide] 

»57f4b476ad01f7cb9d [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <d55991 481 227341 @chan> 
Date: Thu Dec 8 20:02:21 2016 


https://blockchain.info/address/135zDqhbNcmPk3gbyeJmH75yiLdVZechsK?offset=13350&filter=4 


[hide] 

»196f4464b5351f00f3 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <629d91481227824@chan> 
Date: Thu Dec 8 20:10:24 2016 


https://blockchain.info/address/lE14k7ilwVSytoMfbaCnbmhofVMNsZrpLh 


[hide] 

<£ 

»1 ad703db1 bf50ae886 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <81 ddOl 481 228271 @chan> 
Date: Thu Dec 8 20:17:51 2016 




Download new. png 

https://blockchain.info/tx/624075b5d5d56b6 1 9b41 3966297b44 1 ae727fc0 19871 c22676405dd5d8200cc9 

View information about a bitcoin transaction 624075b5d5d56b619b413966297b441ae727fc019871c22676405dd5d8200cc9 

>OMG 

>1 thnk I found it 
>hang on 
>look at this 

https://blockchain.info/block/0000000000000000026fb408f6a035e55cl26al409e9c5f5fea7d22610645289 
transactions contained within bitcoin block 435172 
>scroll down to roughly 

>It's possible that a 7z or other compressed text document with instructions is hidden within a single transaction 
>And that transaction is spent. 

>37 7a be af 27 lc 20 04 Oe 15 c8 Of 26 20 20 20 20 20 20 20 62 20 20 20 20 20 20 20 50 c7 af >be 01 20 21 67 73 63 6c 69 6c 69 70 
74 72 68 6e 65 74 65 65 74 73 67 68 69 6e 61 65 75 6f 64 >69 6e 65 72 72 69 69 20 01 04 06 20 01 09 26 20 07 0b 01 20 01 21 21 01 
20 0c 22 20 08 Od 0a >01 86 66 4f f7 20 20 05 01 19 0c 20 20 20 20 20 20 20 20 20 20 20 20 1 1 17 20 77 20 6c 20 63 >20 6f 20 64 20 
65 20 2e 20 74 20 78 20 74 20 20 20 19 04 20 20 20 20 14 Od 0a 01 20 bd 31 89 >c3 e9 42 d2 01 15 06 01 20 20 20 20 20 

>That's a possible 7z encrypted message, albeit a small one 

https ://blockchain. info/ addres s/lE14k7il wVS ytoMfbaCnbmhofVMN sZrpLh 

Transactions sent and received from bitcoin address lE14k7ilwVSytoMfbaCnbmhofVMNsZrpLh. 

https://blockchain.info/tx/4aadbaa0edd0f0bl9d5e8ae0a818e3ac7fde7cd5f6caedcd9cf4e7ac2b9582e9 

View information about a bitcoin transaction 4aadbaa0edd0f0bl9d5e8ae0a818e3ac7fde7cd5f6caedcd9cf4e7ac2b9582e9 


[hide] 

6 

»f95752327502dbeb0d [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <227331 481 229533@chan> 
Date: Thu Dec 8 20:38:53 2016 


lGiilVoJksAKrL34Gd4sLFlbUTQdUqlqel and i dont know if this is old news but this should be JA's address.. There's a DMS at the 
beginning of the txs 

First being oldest. lFpdrx7Q7fVgfl9imhXeDwNEhBAQVla6Gp 

for example this is one of the 4 txs.. its cryptic so "im dead when back" and likely implies something to do with the hex 

If you look at the oldest tx on Gii, you'll see what looks like a dms.. Y is for key. It's always been here but it needs to be disarmed. 
Thats basically what it is. 

The account basically returns what is sent to it., which is what this 'QdUqlqel' 

The unconfirmed tx has actually been there since this weekend since I found it but it looks like it rejected it and has one from 12/6 
http://gatewav.glop.me/ipfs/QmXUMi6fRG9mNHFTgvthygDJxUodGCnWFkBfcOfaqZo896/outtx.xlsx 

list of unable to decode from block 43525 1 
43525 Lxlsx 

list of unable to decode from block 435252 
435252. xlsx 

http://gateway.glop.me/ipfs/QmTtdJr3sEYeWSHdgWTvP7uq89YRQWvUKbyWYcbeBKY6kh/435251.xlsx 


http://gatewav.glop.me/ipfs/QmUslxK7wf89gf9t4wtdRNPpVdaQgnsniLDBcuBrbFcQT5v/435252.xlsx 

http://gateway.glop.me/ipfs/QmUttF4q2JgizGgKkuJoXvWvUaVZvG47XKAguHDYRXlNXP/block 435250 unable to decode. xlsx 
There's only one that had any actual value associated (it's on the list ending in 51) all other transactions have shown as 0 
an example would be if you find a hex code for a 7zip header 

such as in https://blockchain.info/tx/5c593b7b71063a01f4128c98e36fb407b00a87454e67b39ad5f8820ebclb2ad5 

View information about a bitcoin transaction 5c593b7b71063a01f4128c98e36fb407b00a87454e67b39ad5f8820ebclb2ad5 

at bottom 377ABCAF271C 

that is the hex code for a 7zip header 

also i believe this has footer http://www.7-zip.org/recover.html 

just to make sure im not wasting my time, is it a waste of time to be looking at 

https://blockchain.info/address/135zDqhbNcmPk3gbyeJmH75viLdVZechsK?offset=10800&filter=4 , batches of transactions -20 
each(sometimes significantly more such as the 57 on the 21) at same time, literally thousands of transactions in a row with same file 
size 

throuugh 300 some odd pages, other than the first few, there are only 3 file sizes 
and average bitcoin transaction is -.001 over 84444 transactions 

this one is huge... 

https://blockchain.info/tx/842a 1 7b3a797ec03c7ab856a6e62 1 03c3288e03d790c8dc00a6e9 1 75d 1 64ece0 

https://blockchain.info/address/135zDqhbNcmP k3gbyeJmH75yiLdVZechsK?offset=15250&filter=4 
Transactions sent and received from bitcoin address 135zDqhbNcmPk3gbyeJmH75yiLdVZechsK. 
same size transactions but changes size on oct 9 
fucktons of transactions for weeks all of which are same size 

https://blockchain.info/ip-address/47.89.39.165 , a lot of same size same time transactions and unable to decode output 

http://gateway.glop.me/ipfs/Qmaut7iGTaCoVZE4RAuV6cNBY5B2HxYgZDpaFrpKYKqYgH/Filenames 16D.txt 
http://gatewav.glop.me/ipfs/QmUUWrmeCQrhVQrbVBJqKKBbEWoHEpgWPoKhKi6Yune520/Filenames 16G.txt 


[hide] 

6 

»d671 be43059c9344b9 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <c3f361 481 230563@chan> 
Date: Thu Dec 8 20:56:03 2016 


7b03d286ecb4 1 0884a5e07e41b6a7be 1 509afa99e4e001 003f7 lbb3 1 9dfe84dd 
e0f3a7f25bfb9415all6f26d7f718782157c3772f0e67acc00af2b8aa4309fb7 
603c 128766c75160b533f4f6cfbfl568c9ae7cb238a20791da7437c60afd8 14b 
20aaf28f5030dcb5bcfe9dld2ed632d213671ebef78587e3a629c7a3bdf0d93b 
a2feacf 1 a3e2d 1 e2852326b26e67a22cb784a7c0d6f 1 d992 1 3ee 1 2b389 1 882 1 8 
6e2bead2e61fd87f23e75ad29389f4e58db92b7a96c04e81f5133f29e50f52ac 
d515d0eae9ea00fel6b9335ab946339d6eeef00c7f77c44c2ef41fab738f4401 
da43c8belc81ef20c93014341f7dcb744fff0388fcf6d214a84be4895fa2270b 
this wallet 

https://blockchain.info/address/lAfdbCzDrRrMEq AXkF8kxVRCkPzB8HxoHD?offset=400&filter=l 
wtf? 

must be either a wallet no one cares about or a bug like the wallet with the ripemd hash 00000000000000000000000 


[hide] 



6 

»ae79f491dd8bc72bec [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <bcbdd1 481 231 455@chan> 
Date: Thu Dec 8 21 :1 0:55 201 6 


»f957523275 

https://blockchain.info/address/lGiirVoJksAKrL34Gd4sLFlbUTQdUqlqel 


[hide] 

6 

»8b2068f899ad6c97cd [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <f065c1 481 233292@chan> 
Date: Thu Dec 8 21 :41 :32 201 6 


Possible tip: 

https://blockchain.info/tx/7fle4e76084ab2a44b484358900d74261e4629879dbl73b85251cb54cac21070 

https://blockchain.info/address/lNAQExkFZTFJKQq76KovUosoQEfiY8K9GN 

https://blockchain.info/address/lB896LaaMVJvQD84ko52XN3976gaKA7nXJ 

Multiple 'Escrows'. Seems like addresses are using the change as in cablegate.7z. 

From: 

7141f6c62892c4c3b85aa989ba54b27be274f5200a715439a75d44b3331da30f 
1883ec71f568cb0644606d2fbfd57e9b01d008503f90b6d934b56d548c08f33d 
c9924669d668e2bcc6c64038f6a33c984cff3d8be758852911f8414666034046 
56f5a921d6fe990715fef88b56379ba2716aa80ec02f4310fa47e2e68ae700e4 
eb5403 14f0 1 a8f7930 Ib3b2fdd2f3dbf 1 62f343b38b9 1 3cd860aae2 1 a2a63G4 
f 1 9c5 1 e46adb68e9235637d7b68d59e0bff6bc8cc0 1 03c442 14efcfe9aa 140af 
8e3ble5d7a290d78b0e34fd54c97da3274c3d5al549ffl228bdb63551fblldc6 
5501f5al930640ee9e554a254d8df29al4b5f5fbc97c31aa0232f9a7202976c9 
319ffa215f446d50091d6900c284319d3d95a0c21ff0ec5b77cf0c08ffc22d52 
718c3be4557660259e38e041a04f7703e8ade3803ab79eda3bc700aeeca96628 
bad344983f7bfa0f84f2befae 1 e 1 78c55b90dbecb 1 aadc074643e 1 59e34054f 1 
5fb72ef284c4bfl31ffa57ba957d03e28e4e9e0ce53ceb6a97e84bab3dl lfcld 
60d5d25c4c55a032e3842770495d72ff2f4f7c8 1 1 a522a 1 8e5 lb49e 192132283 
7bafcd844fc308280828d2685ab506bd88310653fe7cf43d380cb21a333bf9dl 
69ac8f52cdad01aa7f5d97ff8903a536e52d43026dfac98dabblffac9343808b 
42 1 8dacb23d2a9a09843e 1 1 e 1 fOc 1 c467ff0640c38 1 c3022b34309d847c73584 


[hide] 

»c2539c0631 59c651 3a [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <699771 481 234496@chan> 
Date: Thu Dec 8 22:01 :36 201 6 



Download! 


I bl HHd'****f H«irf Artec .’etriTilflf «* 

*.2Gtr<n«: lb66l4W4belZZ)01l8?f f 7?lQAc2S3f!Ml49rMiZcM&17A«8EAB7fndC 
k*cflZ?9tecbU26e7Mi:1?fd71U>7!>c<12firier2f4r4»lfei4ra2fib3BtMfie«8B 
HbbnAcZJf JM 7 ?bS 920 S 2 e 7 !iaBbaib , )^%?Mr 7 eece 


all from 435165-435382 (some are missing because API limits), spent < 33%, avg unspent value < 0.001 btc, at least 4 outputs 
https://codepaste.net/ta5hyb 


[hide] 

»0f9986ea56dfeb6460 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <6ad501481236545@web.oniichan.onion> 
Date: Thu Dec 8 22:35:45 2016 


LAAARP 


[hide] 

»af 1 4f49622db67551 5 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <782c61481244785@chan> 
Date: Fri Dec 9 00:53:05 201 6 


arnZd 3 cjeJ 73 *lb*cMdeWI 47 »ibi 7 , 13312 afabl 91 Jcttr 2 d^eba«'HcBc 7 S 
73ff814cZb^nc7J^Uk24ui7t,3Hc*-k6H7BtTgdfb30Er4J1'M.?7<!rSll»2acbef 
UH4 I«BnT 139S# *Wd?.«beBaddBrtbc^a!SbB0t 


Downloadl 

>spent <51%, avg unspent value < lbtc, at least 2 outputs 


ftxs.txt 


[hide] 

& 

»009f6ad4c1 a48c1 6e9 [Replvl 
Subject: None 
Name: Anonymous 



MessagelD: <9492d1481245903@web.oniichan.onion> 
Date: Fri Dec 9 01:1 1:43 2016 


»dc4801 198a 

does anyone have a backup, it was just deleted. 


[hide] 

»ba6cb645293c3824ac [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <58f091 481 2521 1 7@web.oniichan.onion> 
Date: Fri Dec 9 02:55:17 2016 


»0f9986ea56 

You think someone spent thousands of dollars and went through the trouble of putting every single file uploaded to wikileaks into the 
blockchain since 2013 and predicted assange's final statement on Oct 4 and ran the biggest DDoS attacks in history at the right 
moments, flooded the blockchain at the right moments, and deleted files from wikileaks.org, and convinced julian to develop 
rubberhose and to tell people to look into the blockchain, and convinced the wikileaks staff to go missing all at the same time, and 
convinced gavin to die during the ddos attack, and convinced manning to make a statement predicting that this would all happen, and 
convinced the wikileaks twitter to post torrents with no signatures and to pretend they don’t know how to use computers and to stop 
using their public key, and convinced wikileaks email provider to pretend they have a gag order and to like tweets that point it out, and 
ecuador to cut off julians internet access, and julian to never release Clintons deleted emails after saying he would, and for wikileaks to 
stop posting before 10 weeks after publicly saying they would, and julian to say he will step down and that a new way of publishing 
information in a way that cannot be censored on his last statement on October 4, and to convince halfchan and fullchan and plebbit and 
twitter and every site to change their mods and policies so that no discussion of this ever takes place, and convince the US to sell 
ICANN, and lobby for the December 1st rule, and make archive.org change at the exact same time Julian loses his internet so that sites 
can be deleted and modified, 

I dont think you could say someone that is able to do all that is role playing more like just playing with the minds of people like you 


[hide] 

6 

»11d1 89e7ad61 e6b83b [Repivl 
Subject: None 
Name: smash 

MessagelD: <1 5fe81 481 254143@web.oniichan.onion> 
Date: Fri Dec 9 03:29:03 201 6 



Download pol - WL Insurance Thread (l).html 



attached is a backup of the endchan thread with the most valuable post at the bottom, save copies. 


[hide] 

6 

»726ec69d565a3022ed [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <1a3d21481256826@web.oniichan.onion> 
Date: Fri Dec 9 04:1 3:46 201 6 


»lldl89e7ad 

do you have one that has the 7z footer and the screenshot of the deleted podesta emails? 


[hide] 

»759d941 88a7d8f970a [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <33ab1 1481298043@2hu.tld> 
Date: Fri Dec 9 15:40:43 2016 


Come help in the open at discord. The more people doing this, the less likely it can be stopped. https://discord.gg/3eV4N 
#blockchain 


[hide] 

»abb08f2e7f28491d5c [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <995921 481 298670@2hu.tld> 
Date: Fri Dec 9 15:51:10 2016 


You fools trying to shill. Get fucked. Anyone who is actually doing this know it's real. There are people like group one and Jean that 
are dishonored by this. The real heroes of our cause. Keep fighting. Spread knowledge. Work in the open, post results. Once enough 
ppl are doing this, there is no stopping it. 


[hide] 

»b1 ca00e41 0aa0dcd73 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <f0c561 481 298749@2hu.tld> 
Date: Fri Dec 9 15:52:29 2016 




[hide] 

»5b28cba40b79ea20fe [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <ed5e61481298878@2hu.tld> 
Date: Fri Dec 9 15:54:38 2016 



I Screenshot 201 61 208-223040. png 


This post went missing off endchan. Please reply with results 


[hide] 

»bf46d46a74a9329039 [Replvl 
Subject: Possible dms wallet? 

Name: Anonymous 

MessagelD: <370901 481 3001 25@2hu.tld> 
Date: Fri Dec 9 16:15:25 2016 


B 1GU1V0JksAXri]4Gd4SI.F IbOTOdUqlqell 

IMG 20161209 080758.jpg 

1 Gii 1 Vo Jks AKrL34Gd4sLF 1 bUTQdUq 1 qe 1 

Possible dms wallet. Having issues posting it on polak. Could be nothing, could be everything. 


[hide] 

i 

»b51 b098a931 dd3bfe3 [Replvl 
Subject: None 



Name: Anonymous 

MessagelD: <96e441481300647@web.oniichan.onion> 
Date: Fri Dec 9 1 6:24:07 201 6 


>discord 

GET FUCKED FBI 


[hide] 
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»efb16a441f6e58bb8d [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <f5351 1 481 301 527@2hu.tld> 
Date: Fri Dec 9 1 6:38:47 201 6 


If I was fbi, I wouldn't be asking for help. And I would likely trying to direct ppl to Echo chambers full of cp on onions. I'm just a 
normie that has been working this for almost two months. We need to work in the open so our data isn't lost, and we don't waste time 
repeating the same things. Let's all work together to break this system of child fuckers and ass holes trying to destroy our future. 
Infighting is an insult to Jean, group one, and the others that lost so much over this. We need the normies on board, places like discord 
are good locations to train others of how to retrieve the data and keys. We aren't there yet, but we are close. Please come help if 
willing 


[hide] 

»a9d0daaeedfca471 6c [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <face21 481 31 0368@web.oniichan.onion> 
Date: Fri Dec 9 1 9:06:08 201 6 




Download 2ARMS.FLI Down load 



APACHE. FLI Download BUGS.FLIDownload 



sample .FLI videos, this format is commonly used for maps like this 

https://woodshole.er.us gs.gov/operations/modeling/circulation.html they come out of cad software like autodesk 

http://gatewav.glop.me/ipfs/QmTUHgamFvoUwesutXosfGprHYMn2vwX6MGp3ryYKDxDiQ/2AJRMS.FLI 

http://gateway.glop.me/ipfs/QmTvBvE3pVGpnsg2eavYlkmxHfguXDixC5nZfvxz3hWyL4/APACHE.FLI 

http://gateway.glop.me/ipfs/QmV2ihMzqdr3S35YCrukhhAClKnKKQ36UYGSXM7Zs9H9J2/BUGS.FLI 

http://gateway.glop.me/ipfs/QmdxiHSGTZkuvi6gaPmXWDDLCixbqbEiY5ZZbamBRUQ8DT/MANTA.FLI 

http://gateway.glop.me/ipfs/Qmd8oTT3YsYRswxWxAfaGWdZNyxGlpcEAKMe8fCLaNa8JK/MSH.FLI 


[hide] 




6 

»9861bdd39ec6e4551d [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <45e1 614813111 53@chan> 
Date: Fri Dec 9 19:19:13 2016 



HOW TO SPLIT AND UPLOAD GIANT FILES: 


1. Take giant file and slip it into pieces with 7zip 

Linux: http://superuser.com/questions/184557/how-to-create-multipart-7zip-file-in-linux 
Example: 

7z -vlOOm a my_zip.7z my_folder/ 

Windows: http://www.linglom.com/it-SLipport/how-to-split-a-large-file-using-7-zip/ 

2. Upload the pieces to mega.nz or filedropper (max 5GB): 
filedropper.com 

mega.nz 

2b (optional). Do it from the command line to save time: 
https://megatools.megous.com/ 

Example: 

https://www. youtube. com/watch?v=LWfFMysaspQ&feature=voutu.be 

FILES WE NEED UPLOADS FOR: 

1. All insurance files 

2. Blockchain 

3. SQL databases of the blockchain 

4. wikileaks.org 


[hide] 

& 

»5732a962f93c8970b0 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <b769a148131221 9@web.oniichan.onion> 
Date: Fri Dec 9 1 9:36:59 201 6 


jOdumpprivkey <3 lqneokFGwpEkoZRksjymxZAiTEmAim3Ab> 


[hide] 

6 

»c5d8fbc4d9a83d61 Ob [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <91 65c1 4813131 59@web.oniichan.onion> 
Date: Fri Dec 9 19:52:39 2016 


If the internet goes down soon: 




https://www.geckoandfly.com/22562/chat-without-intemet-connection-mesh-network/ 

http://www.cnn.com/2014/10/16/tech/mobile/tomorrow-transformed-firechat/ 

http://hyperboria.net/ 


[hide] 
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»da8888232e3afa73fb [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <24c361 48131 3472@chan> 
Date: Fri Dec 9 19:57:52 2016 
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[hide] 
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»a2344986d69fcfe2f1 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <037701 481 31 4531 @chan> 
Date: Fri Dec 9 20:15:31 2016 



[hide] 
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»ed063208bfb0fbe26b [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <8624a1481315989@2hu.tld> 
Date: Fri Dec 9 20:39:49 2016 


Ail* 12 2 « 


eodchan xyz 


0 




MOW TO SPLIT AND UPLOAD GIANT FMES 

1 Take gtam Me and «Hp it r«o pieces with 7xip 

Unui httfl *u pen-an' com.' queaboni. 1 \ B455?/how to 
ctealefTKitoaft (Me »f> trux 

Example 

7x v loom a mr.x<p 7x my.fotdcr/ 

Window httav/ttw* Irpkxncrrr oit <**w rtVhtnrlt> 
ink e Ik pc- f 4 c wvro 7 -xtPi 1 

2 Upload t*e pieces to met)a nx or ffedropptf (max 
SOS) 

Me<Voppercom 

meganx 

2b i optional i Do A from the command tone to ««•« ume 
httas j'/megrtocrfs megouvcom/ 

Example 

jtube com.'wetdiV'LWff MysaspO 
Afe«!ufe*youtu be 

FILES WE NEED UftOADS fQK 

1 AM mti/mce Met 

2 BtocJuKMn 

3 SOL database* of ow dockcham 

4 Miljteaks org 


helps /rtoutul 


lOdumpprwkey 
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Downloadl 


I Screenshot 201 61 209-1 22639. png 


[hide] 
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»08e1 931 bcec8f8e0cf [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <4a4d01481316852@2hu.tld> 
Date: Fri Dec 9 20:54:12 2016 


Guy’s, we are getting close. If tor is compromised, the shadows will only work against our ultimate goals. Remaining isolated will 
only allow the work you have done to be hidden. Please post results here. Any group that has made it, please start work on a normie 
proof breakdown so that we can begin to spread that shit. 


[hide] 
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»41fc90206eaf47eb4d [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <55ddc1 48131 81 1 1 @chan> 
Date: Fri Dec 9 21:15:11 2016 





Download EndChanPOL Thread.zip 

full endchan thread 


[hide] 

»3f03f2a70c91c6da40 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <037541 481 31 81 31 @web.oniichan.onion> 
Date: Fri Dec 9 21:15:31 2016 



>Guy's, we are getting close. 


[hide] 
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»3d5696481 70add5543 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <68fdc1 48131 81 90@chan> 
Date: Fri Dec 9 21:16:30 2016 


»41fc90206e 

https://mega.nz/#!sIJEGapA!BstPxHzd-qO3s63uXsG0Zty7znPT14oJKuWVu56V450 


[hide] 
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»4e9be9610de7a35141 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <9fa46148131 9103@web.oniichan.onion> 
Date: Fri Dec 9 21:31:43 2016 


»08el931bce 

>if tor is compromised 

5 years late brah 


[hide] 

»c3d1 8c7d881 58a0a30 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <91 3f1 1481 31 9332@web.oniichan.onion> 
Date: Fri Dec 9 21:35:32 2016 


»efb!6a441f 

>echo chambers full of cp on onions 

you DO know that that is what most people think this place is, right? 


[hide] 
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»8bc4247e838bd29ffc [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <498f71481 32091 O@web.oniichan.onion> 
Date: Fri Dec 9 22:01:50 2016 


»3f03f2a70c 

everyone note this shill that uses meme generator and impact font, he spent a lot of time doing this shit at 8ch before, bounce ideas off 
of him and he'll tell you what are the good leads by 'debunking' them. 


[hide] 

»86c065d1 al e6e841 04 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <bc7051481321028@web.oniichan.onion> 
Date: Fri Dec 9 22:03:48 201 6 


»8bc4247e83 
pizzagate is HARD D: 


[hide] 



& 

»99f21840f3552d0055 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <0b781 1481 321 393@chan> 
Date: Fri Dec 9 22:09:53 2016 


»86c065dlal 

no one cares about pizzagate here, stop trying to discredit this with your shitty pizzagate memes. 


[hide] 
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»ebfbb23dcd05882f80 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <4f8421481321470@web.oniichan.onion> 
Date: Fri Dec 9 22:11:10 2016 


»99f21840f3 
chew on this appetizer 

>pizzagate is a Jewish conspiracy to destroy the family unit by providing the media a narrative to normalize pedo 


[hide] 

»9806cfaecd5183dd68 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <79cce1 481 321 785@web.oniichan.onion> 
Date: Fri Dec 9 22:1 6:25 2016 


>autism powered tsunami 

that's the new pisswave? YES LET’S RIDE IT NIGGAH. 


[hide] 
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»cafeeb290c00fb90e1 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <f 1 31 cl 481 321 824@2hu.tld> 
Date: Fri Dec 9 22:17:04 2016 


I’m not worried. We're close. They know it. Cannot stop a tsunami. Especially when it's powered by autists. Please keep posting finds 
and methods ppl. We have become wise to their tools., they are pathetic. And traitors 


[hide] 

6 

»e5e91 4d567b822c8c1 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <995da1481321882@web.oniichan.onion> 
Date: Fri Dec 9 22:1 8:02 2016 



lolz 2hu's clock was waaaaay off 


[hide] 
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»550bc7b2bfd043973e [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <1 9f091 481 328262@web.oniichan.onion> 
Date: Sat Dec 10 00:04:22 2016 


https://i. imgur.com/nTYDpPb. png 


[hide] 
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»adefcde4037b854d54 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <1 6bab1 4813291 59@web.oniichan.onion> 
Date: Sat Dec 10 00:19:19 2016 


»550bc7b2bf 

unless it's cp you should never link to it instead of posting it here 
fucking niggers 


[hide] 

»61 fea0c351 277f8dfc [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <eb7471481329338@web.oniichan.onion> 
Date: Sat Dec 10 00:22:18 2016 





»adefcde403 

NIGGER 


[hide] 
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»f03cada9d1 7a6636ef [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <3e1 d41 481 331 269@web.oniichan.onion> 
Date: Sat Dec 10 00:54:29 2016 


34 34 31 37 36 36 38 36 30 

"It's the epoch time for Jan 1, 1984 1:01" 


[hide] 
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»93c1 dbbf5741 5d1 Odf [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <81f0a1481336762@web.oniichan.onion> 
Date: Sat Dec 10 02:26:02 2016 


most are not verified 
headers: 

docDOCFllEOAlBl 1AE1 

xlsDOCF 11 E0 A1 B1 1AE1 

ppt D0CF 11 EO A1 B1 1A El 

zip 50 4B 03 04 14 (I think this one is wrong) 

jpg FF D8 FF EO 00 10 4A 46 49 46 00 01 01 

gif 47 49 46 38 39 61 4E 01 53 00 C4 

pdf 25 50 44 46 2D 31 2E (I think this one is wrong too) 

7zip 37 7A BC AF 27 1C (verified at endchan) 

Torrent 64 38 3A 61 6E 6E 6F 75 6E 63 65 
AVI 52 49 46 46 

footers: 

doc 57 6F 72 64 2E 44 6F 63 75 6D 65 6E 74 2E 

xls FE FF FF FF 00 00 00 00 00 00 00 00 57 00 6F 00 72 00 6B 00 62 00 6F 00 6F 00 6B 00 

ppt 50 00 6F 00 77 00 65 00 72 00 50 00 6F 00 69 00 6E 00 74 00 20 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 

zip 50 4B 05 06 00 (probably wrong) 

gif 2 1 00 00 3B 00 

pdf 25 25 45 4F 46 (probably wrong) 

7zip 00 00 00 17 06 (verified with cablegate) 

we are waiting for someone to post the headers and footers for all pgp, gpg files, they can be found by searching for common hex 
blocks in different files of the same type, someone finished this list but has not posted it. hopefully it's up today, we also are trying to 
get a list of all header/footers found in wikileaks.org/file. if you have some please post here, no links to sites with headers, most of 
them are not real we've found. 


[hide] 
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»4d6502130ea1 e71 6ed [Replvl 
Subject: None 
Name: Anonymous 



MessagelD: <73e3a1 481 345479@chan> 
Date: Sat Dec 1 0 04:51 :1 9 201 6 


»93cldbbf57 

I used a batch with GPG on bash for an 8192 key 

Key-Type: RSA 
Key-Length: 8192 
Name-Real: Name 
Name-Email: name@email.com 
Expire-Date: lOy 

Preferences: SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES TWOFISH CAST5 BZIP2 ZLIB ZIP Uncompressed 
That let me create an 8192 key. 
and Thanks for the input! 


PGP 2048 PUBLIC KEY HEADER 
mQENBFhLe 

PGP 4096 PUBLIC KEY HEADER 
mQINBFhLe 

PGP 2048 KEY PAIR HEADER 

.XK (with this there was suble variety before the string to the left, either >, 1/2, or 3/4 before the ".") for example, these are the strings 
in three test files: 

1: r'A.XKz 
2: *.>.XK{ 

3: *. 3 /4.XK| 

PGP 4096 KEY PAIR HEADER 

\>.XKz (this was consistent across 2 test fdes) 

PGP 4096 PRIVATE(SECRET) KEY HEADER 
•>.XKz 

PGP 2048 PRIVATE KEY HEADER 

similar results to the key pair, three files. 2048 may have something different going on than 4096. 

1: r'A.XK 
2: *.>.XK 
3: *. 3 /4.XK 

PGP 4096 PRIVATE KEY HEADER 
•>.XKz 

8192 isn't supported by kleo generation so i'm lookin for a way to do that, if someone else can chip in i'd apprecaite it. 

Hope this helps. 


Yes, outside the BEGIN PUBLIC/PRIVATE KEY part. You don't need to convert it to hex I can do that but it would help 
doccumenting it like the previous magic numbers posted. 2048, 4096, and 8192 keys are what I want to search for. 


I presume you mean outside of the BEGIN PUBLIC PGP KEY etc. strings right? 


[hide] 


»22f21 977734381 dea7 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <3c7dd1 481 353657@chan> 
Date: Sat Dec 10 07:07:37 2016 


There news that some groups are starting to find torrent headers in the blockchain. Some advice regarding that. 

1. Check the file structure. 

A torrent file is a bencoded dictionary with the following keys: 
announce — the URL of the tracker 

info — this maps to a dictionary whose keys are dependent on whether one or more files are being shared: 

name — suggested filename where the file is to be saved (if one file)/suggested directory name where the files are to be saved (if 
multiple files) 

piece length — number of bytes per piece. This is commonly 28 KiB = 256 KiB = 262,144 B. 

pieces — a hash list, i.e., a concatenation of each piece's SHA-1 hash. As SHA-1 returns a 160-bit hash, pieces will be a string whose 
length is a multiple of 160-bits. If the torrent contains multiple files, the pieces are formed by concatenating the files in the order 
they appear in the files dictionary (i.e. all pieces in the torrent are the full piece length except for the last piece, which may be 

shorter). 

length — size of the file in bytes (only when one file is being shared) 

files — a list of dictionaries each corresponding to a file (only when multiple files are being shared). Each dictionary has the 
following keys: 

path — a list of strings corresponding to subdirectory names, the last of which is the actual file name 
length — size of the file in bytes. 

2. Check the tracker information. 

Multiple trackers 

BEP-0012[4] extends BitTorrent to support multiple trackers. 

A new key, announce-list, is placed in the top-most dictionary (i.e. with announce and info) 

{ 

’announce-list': [['<trackerl-url>']['<tracker2-url>']] 

} 

3. If it a single file or Multi file torrent 
Single file[edit] 

Here is what a de-bencoded torrent file (with piece length 256 KiB = 262144 bytes) for a file debian-503-amd64-CD-l.iso (whose size 
is 678 301 696 bytes) might look like: 

{ 

'announce': ' http://bttracker.debian.org:6969/announce' ;, 

'info': 

{ 

'name': ’debian-503-amd64-CD-l.iso', 

'piece length': 262144, 

’length’: 678301696, 

’pieces’: '84 1 ae846bc5b6d7bd6e9aa3dd9e55 1 559c82abc 1 . . .d 14f 1 63 1 d776008f83772ee 1 70c424 116181 90a4' 

} 

} 

{ 

’announce': ' http://tracker.sitel.com/announce' :, 

'info': 

{ 

'name': 'directoryName', 

'piece length': 262144, 

'files': 

[ 

{'path': [Tll.txf], 'length': 111}, 

{'path': ['222.txt'], 'length': 222} 

], 

'pieces’: ’6a8af7eda90ba9f851831073c48ea6b7b7e9feeb...8a43d9d965a47f75488d3fb47d2c586337a20b9f 




4. Trackers 

You can see the tracker in: 

'announce': ' http ://bttracker. debian. org: 6969/announce' ; , 

5. Check the trackers to see if the files are valid. 

Trackers themselves should be verified by Verisgn or any other tool for tracker verification. 

If the file is downloaded, keep it and post it here. If the torrent was incomplete or corrupted it might be possible to fix it with file 
recovery software. 


[hide] 

»21 7e9fac3c6a5f5352 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <ccc271 481 384761 @chan> 
Date: Sat Dec 10 15:46:01 2016 



1. What are shills? 
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2. How do I spot shills? 
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3. Interacting with shills 
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4. excerpts from guides 
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use this 


[hide] 
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»e1 75d2ba54095f1 3de [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <aafc21481385305@chan> 
Date: Sat Dec 10 15:55:05 2016 


»93cldbbf57 
»4d6502130e 
list used on the git code 


if " DOCF 1 1 EO A 1 B 1 1 AE 1 " . lo wer() in hexcode: 

filetype += "DOC Header Found " # DOC Header 

if "576F72642E446F63756D656E742E".lower() in hexcode: 
filetype += 'DOC Footer Found " # DOC Footer 

if " DOCF 1 1 EO A 1 B 1 1 AE 1 " . lo wer() in hexcode: 

filetype += "XLS Header Found " # XLS Header 

if "FEFFFFFF000000000000000057006F0072006B0062006F006F006B00".lower() in hexcode: 
filetype += "XLS Footer Found " # XLS Footer 

if " DOCF 1 1 EO A 1 B 1 1 AE 1 " . lo wer() in hexcode: 

filetype += "PPT Header Found " # PPT Header 

if " A046 1 DFO" . lo wer() in hexcode: 

filetype += "PPT Footer Found " # PPT Footer 

if "504B030414".lower() in hexcode: 

filetype += "ZIP Header Found ” # ZIP Header 

if ”504B050600".lower() in hexcode: 

filetype += "ZIP Footer Found " # ZIP Footer 

if ”504B030414000100630000000000".lower() in hexcode: 
filetype += "ZIPLock Footer Found " # ZLocked Encrypted 

if "FFD8FFE000 1 04A464946000 101" .lo wer() in hexcode: 
filetype += "JPG Header Found " # JPG Header 

if "47494638396 1 " .lo wer() in hexcode: 

filetype += "GIF Header Found " # GIF Header 

if "474946383761 ".lower() in hexcode: 

filetype += "GIF Header Found " # GIF Header 

if ”2100003B00".lower() in hexcode: 

filetype += "GIF Footer Found " # GIF Footer 

if "25504446". lower() in hexcode: 

filetype += "PDF Header Found " # PDF Header 

if "2623323035". lower)) in hexcode: 

filetype += "PDF Header Found " # PDF Header 

if "2525454F46". lower!) in hexcode: 

filetype += "PDF Footer Found " # PDF Footer 

if "616E6E6F756E6365". lower!) in hexcode: 

filetype += "Torrent Header Found " # Torrent Header 

if "1F8B". lower!) in hexcode: 

filetype += '.TAR.GZ Header Found " # TAR/GZ Header I Going to have lots of false positives 

if "001 1AF". lower!) in hexcode: 

filetype += "FLI Header Found " # FLI Header 

if "504B03040A000200". lower!) in hexcode: 

filetype += "EPUB Header Found ” # EPUB Header 

if "89504E470D0A1A0A". lower!) in hexcode: 

filetype += "PNG Header Found ” # PNG Header 

if "6D5 15 14E42". lower!) in hexcode: 

filetype += "8192PGP Header Found ” # 8192 Header 

if "6D51494E4246672F". lower!) in hexcode: 
filetype += "4096PGP Header Found " # 4096 Header 



if "952e3e2e584b7a". lower in hexcode: 

filetype += "2048PGP Header Found " # 2048 Header 

if "52617221 lA0700".lower() in hexcode: 

filetype += "Secret Header Found" # Secret Header 
if "6D51454E424667".lower() in hexcode: 

filetype += "RAR Header Found" # RAR Header 
if " EFEDFACE" . lo wer() in hexcode: 

filetype += "UTF8 Header Found" # UTF8 header 
if "4F676753".lower() in hexcode: 

filetype += "OGG Header Found" # OGG Header 
if "42494646". lower() in hexcode and "57415645". lower() in hexcode: 
filetype += "WAV Header Found" # WAV Header 
if "42494646". lower() in hexcode and "41564920". lower() in hexcode: 
filetype += "AVI Header Found" # AVI Header 
if "4D546864".lower() in hexcode: 

filetype += "MIDI Header Found" # MIDI Header 
if "377ABCAF271C".lower() in hexcode: 

filetype += "7z Header Found" # 7z Header 
if " 0000001706". lower() in hexcode: 

filetype += "7z Footer Found" # 7z Footer 


[hide] 

»9b230ecdadb7e0ce00 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <90ee81 481 5061 09@web.oniichan.onion> 
Date: Mon Dec 1 2 01 :28:29 201 6 


with hyperlinks to blockchain.info for each 


all non-standard transactions from the first 85% of the blockchain 


whats in the big dump? 


[8:16 PM] x: 

https://cdn.discordapp.com/attachments/250364840667906048/257677Q41313251328/patterns.txt 

[8:16 PM] x: this was ran on 85% of the blockchain 

[8:16 PM]x: with this we can easily identify the patterns used to store data 

[8:17 PM] x: and the big dump 

[8:17 PM]x: https://mega.nz/#!soVW3Iia!MeqMJFf4-lUZbDWfdpQp3fqBiVlVs-liMefNXuUHS0g 


https://github.com/WikiLeaksFreedomForce 

https://discordapp.com/invite/4yaZgkD #blockchain (fastposting but twitter levels of compromised) 
https://endchan.xyz/POLAK/res/15.html 

https://2hu-ch.org/thread-5b30554cf29073d3aeela74c298234c8e36a7bad.html 

updates from people are not really not coming thru, posts from findings have been ded for a while, groups must be keepign them to 
themselves or the messages are lbocked somehwo. if findings dont start coming thru the next group will probably have to start from 
scratch (for the 4th time now...) we waiting for this also. 

HOW TO SPLIT AND UPLOAD GIANT FILES: 

1. Take giant file and slip it into pieces with 7zip 

Linux: http://superuser.eom/questions/l 84557/how-to-create-multipart-7zip-file-in-linux&nbsp ; 

Example: 



7z -vlOOm a my_zip.7z my_folder/ 

Windows: http://www.linglom.com/it-SLipport/how-lo-splil-a-large-file-using-7-zip/ 

2. Upload the pieces to mega.nz or ftledropper (max 5GB): 

ftledropper.com 

mega.nz 

2b (optional). Do it from the command line to save time: 
https://megatools.megous.com/ 

Example: 

https://www. youtube. com/watch?v=LWfFMysaspQ&feature=voutu.be 

FILES WE NEED UPLOADS FOR: 

1. All insurance files 

2. Blockchain 

3. SQL databases of the blockchain 

4. wikileaks.org 


Where's everyone at with this? 


[hide] 

»54f3e542de33b7b03d [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <7ef001481506637@web.oniichan.onion> 
Date: Mon Dec 1 2 01 :37:1 7 201 6 


»9b230ecdad 

the most recent revisions can be found at https://github.com/manly/BlockChainParser which is cited in the WLFF repo 


[hide] 

6 

»7041 dl 99d3350b5bbf [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <5a9961481509394@chan> 
Date: Mon Dec 1 2 02:23:1 4 201 6 


Intel dump: 

http://zerobinqmdqd236y.onion/?7cd87b53cal99bdb#+Ht0Kg+aa8Nqx4oKXQIPM9UZibcVuZMMBMw221c/+pw= 


[hide] 

6 

»61 6801 6d6d48f9af5f [Reply! 

Subject: None 

Name: Anonymous 

MessagelD: <1 8fcf1 481 51 1 1 33@chan> 

Date: Mon Dec 1 2 02:52:1 3 201 6 




»5b30554cf29073d3ae [Replvl 
Subject: WE ARE PHASE3 

Name: oldfag 

MessagelD: <2a0901 47933761 8@web.oniichan.onion> 
Date: Wed Nov 16 23:06:58 2016 


Download Hoxha.jpg 
I declare this to be a throw away bunker. 

IF YOU DETECT SOMETHING FOREIGN ABANDON THREAD 


[hide] 


»5bd3397b509c8a41 35 fRepIvl 
Subject: None 
Name: Anonymous 

MessagelD: <2da981479339022@web.oniichan.onion> 
Date: Wed Nov 16 23:30:22 2016 


THREADS: 

https://s6424n4x4bsmqs27.onion.to/pol/res/20366.html 

https://web.archive.Org/web/20161030073742/http://8ch.net/pol/res/7946506.html 

https://web.archive.org/web/2016102321 1 637/https ://oxwugzccvk3dk6tj. onion, to/pol/res/793 1897.html 

https://web.archive.Org/web/20161024220236/http://8ch.net/pol/res/7962287.html 

https://boards.4chan.org/pol/thread/98716471 

https://oxwugzccvk3dk6ti.onion.to/pol/res/81 80723. html#q8 192699 

https://oxwugzccvk3dk6ti.onion.to/tech/res/679042.html 

FILES: 

https://file.wikileaks.org/torrent/2016-l 1-07 WL-Insurance US. aes256. torrent 
https://file.wikileaks.org/torrent/2016-l 1-07 WL-Insurance UK.aes256. torrent 
https://file.wikileaks.org/torrent/2016-l 1-07 WL-Insurance UK.aes256. torrent 
https://file.wikileaks.org/torrent/2016-06-03 insurance. aes256. torrent 
https://file.wikileaks.org/torrent/wikileaks-insurance-20120222.tar.bz2.aes.torrent 
https://file.wikileaks.org/torrent/wlinsurance-20130815-A.aes256.torrent 
https://file.wikileaks.org/torrent/wlinsurance-20130815-B.aes256.torrent 




https://file.wikileaks.org/toiTent/wlinsurance-20130815-C.aes256.torrent 

https://web.archive.Org/web/20100901162556/https://leakmirror.wikileaks.org/file/straw-glass-and-bottle/insurance.aes256 

BM: 

[chan] wikileaks 

[name] BM-2cVFHKC263sXfXYF7JU3n4FPLY9HD5H7SC 
HASH SHIT: 

US Kerry [1]- 4bb96075acadc3d80b5ac872874c3037a386f4f595fe99e687439aabd0219809 
UK FCO [2]- B3a6de5c627e3270ed3e02f62cd0c857467a780cf6123d2172d80d02a072f74 
EC [3]-eae5c9b064ed649ba468f0800abf8b56ae5cfe355b93blce90alb92a48a9ab72 

sha256sum 2016-11 -07_WL-Insurance_US . aes256 ab786b76a 1 95cacde2d94506ca5 1 2ee950340f 14042443 127781 44f67d4c8002 
sha256sum 2016-1 l-07_WL-Insurance_UK.aes256 655821253135f8eabff54ec62c7f243a27dld0b7037dc210f59267c43279a340 
sha256sum 2016-1 l-07_WL-Insurance_EC.aes256 b231ccef70338a857e48984f0fd73ea920eff70ab6b593548b0adcbdl423b995 
https://wiki.installgentoo.com/index.php/Wiki Backups 
https://wikileaks.org/wiki/Afghan War Diary, 2004-2010 

FBI ANON: 

https://archive.is/JEXOo 

https://archive.is/pgLpf 

https://archive.is/OnuFe 

http://archive.is/Wt2T0 

https://archive.is/Nct7R 

https://archive.fo/E9YD8 

http://archive.is/0oVo3 

OPENS SL BUG: 

https://github.com/openssl/openssl/blob/master/crypto/evp/evp key.c#L74 

https://web.archive.Org/web/20150921141747/http://security. stackexchange.com/questions/29106/openssl-recover-kev-and-iv-by- 
passphrase/29 1 39 

>The EVP_BytesToKey key derivative algorithm uses md5. It is trivial to break the key for the first block. 

>AES decrypts in blocks 256 bytes at a time, take one of the insurance files, copy the first 256 bytes, make a new tiny file and use the 
key on that, if the data is compressible or has runs on zeros or consant values or has some known values in it, then the key is right 
>https://link. springer.com/chapter/ 10.1 007 %2F 118 14948_ 1 3 
[code]head -c 256 file > newfile[/code] 

>salts 

[code] strings wlinsurance-20130815-A.aes256 I head -c 16[/code] 

BITCOIN LEADS: 

691dd277dc0e90a462a3d652al 171686de49cfl9067cd33c7df0392833fb986a 

7379ab5047bl43c0b6cfe5d8d79ad240b4b4f8cced55aa26f86dld3d370c0d4c 

d3c 1 cb2cdbf07c25e3c5f5 1 3de5ee3608 1 a7c590e62 1 f 1 f 1 eab62e8d4b50b635 

Cce82f3bde0537f82a55f3b8458cb50d632977f85c81dad3el983a3348638f5c 

2al4783f74796ace53e0a6859a7012723d3d6cd9dacf72d4e90a3394484093df 

657aecafe66d729d2e2f6f325fcc4acb850 1 d8f025 12d 1 f5042a36dd lbbd2 Id 1 

05e6c80d9d6469e7dl328e89b9d971bl9972594701586bbcbd70070f2be799db 

623463a2a8a949e0590ffe6b2fd3e4el028b2b99c747e82e899da4485eb0b6be 

5143cf232576ae53e8991ca389334563fl4ea7a7c507a3e081fbef2538c84f6e 


[hide] 


»faa772af9b44a75589 [Reply] 

Subject: None 
Name: OP 

MessagelD: <e1 81 al 47933931 7@web.oniichan.onion> 
Date: Wed Nov 16 23:35:17 2016 



»5bd3397b509c8a4135 

Thanks for posting that for my lazy ass anon. 


[hide] 


»c3c2551 e4de82e1 ca6 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <889f91479339509@changolia> 
Date: Wed Nov 16 23:38:29 2016 


>OP_RETURN data scraped from BTC Blocks around 15th Oct. Planning on doing up until 25th Oct, but power outage and not sure 
where it stopped: 

gateway. glop. me/ipfs/QmXfLkggUEdNvJt4ZKHZLxL4kdil9pWX6G6JVeZ4doodTE/434304 434250ish.txt. gz 
>(HINT: Bruteforce the insurance files!) 

>Script for you to perform this OP_RETURN scrape yourself: 

gateway. glop. me/ipfs/QmaVdcqSowfbr58295ipeZxUU97FmqLXBadBgjcXwuqXa9/block-opreturn-finder.py 

>Change RPC user/pass in code (txindex = 1 must also be set in bitcoin.conf). 

>Use with: 

>python block-opreturn-finder.py blocks 434304 4357 11 # Oct 15 through Oct 25 


[hide] 


»837547b82abc9b1 7f6 [Reply] 

Subject: None 
Name: OP 

MessagelD: <6f6281 47933971 1@web.oniichan.onion> 
Date: Wed Nov 1 6 23:41 :51 201 6 


Should I post an onion link that logs bitmessage chans, or should I wait for the real bunker? 


[hide] 


»cf7ef0caf8c1 83f294 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <387421 479340082@changolia> 
Date: Wed Nov 1 6 23:48:02 201 6 


SITE FUCKERY: 

>For one example, go to https://file.wikileaks.org/torrent/ 

>Ctr+F '09-Nov-438498967 06:00', which is not the format the use for dates. 

>Look at the file. You can download a copy of this file from Oct 21 2016 here: 

https://archive.org/details/SaudiArabiaDatabaseFromWikileaks 

>and from June 2015 here: https://archive.is/TdJ4t 

>You can then use the ’diff to compare the files. The output is ’the binaries differ'. 

>That torrent file timestamp was corrupted as back as Jul 25 
http://archive.is/09Gu5 

>podesta 33 started at 53000. podesta 32 ended at 52481. they skipped 518 that are online 52481-52999. duplicates everywhere doing 
empty search gives you less emails than there are online. 

>wikileaks still shows 27515 emails for the dnc but in reality there are 44052 (16537 emails are not indexed) 



TWITTER FUCKER Y: 

>video posted with accidental link 
https ://twitter. com/wikileaks/ status/7 95706165971841 024 
>seems like a random fan girl is running the account 
https://twitter.eom/m cetera 


[hide] 


»75c30e666554ddb025 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <379a61 4793401 72@changolia> 
Date: Wed Nov 16 23:49:32 2016 


»faa772af9b 

we can't post everything that happens in BM because alphabets drop in to give hints and don’t want it to be logged 


[hide] 


»d3b38aeb0bea00c7bf [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <8e3b51479340204@web.oniichan.onion> 
Date: Wed Nov 16 23:50:04 2016 


nigguh wut 


[hide] 


»87f9f5501 6cb9d1 583 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <cc4911479340428@web.oniichan.onion> 
Date: Wed Nov 16 23:53:48 2016 


»75c30e666554ddb025 

But the site already logs it... along with other unrelated bitmessage channels.. 


[hide] 


»34d21 b86e073e6a772 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <03a5d1479340502@chan> 
Date: Wed Nov 16 23:55:02 2016 


oh, there's a bitmessage chan most of you congregated on? 

Either way, I don’t see the point. My only opinion 

>$current_year still using FIoC 



[hide] 


»b35f20b30ce3ce8499 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <59c601479340582@changolia> 
Date: Wed Nov 16 23:56:22 2016 


BLOCKCHAIN ATTACKS: 

>1 know the mempool was flooded a day or two afterwards (40000 transactions as opposed to the usual 4000 or so), but this could've 
been an attack to thwart and discourage adoption of Bitcoin 0.13.1 (SegWit) by those that don't support it. (The timing here is 
suspicious.) 

10/26 

>43000 unconfirmed transactions in the mempool. $10 fees. 

10/28 

https ://ww w.reddit.com/r/Bitcoin/comments/59qiyg/is_there_some_attack_going_whats_with_large/ 

11/7 

https://www.reddit.eom/r/Bitcoin/comments/5bizrb/lblock confirmation fee estimates are absurdly/ 


MANNING STATEMENT: 

https://www.documentcloud.org/documents/3213878-Binder2.html 


[hide] 


»4b2dd88dbbe52e3ad2 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <555491 479340695@chan> 
Date: Wed Nov 16 23:58:15 2016 


»837547b82a 

The point? »5bd3397b50 

>[chan] wikileaks 

>[name] BM-2cVFHKC263sXfXYF7JU3n4FPLY9HD5H7SC 
»75c30e6665 

But BMchans are still public.... 


[hide] 


»626c2f4d3bb89d1 01 1 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <7ff881479340785@changolia> 
Date: Wed Nov 1 6 23:59:45 201 6 


PHONE CALLS: 

https://web.archive.Org/web/20161017101519/h ttps://bigstorv.ap.org/article/6f997f97c5fl40a29f385ea05flb642c/wikileaks- 

assanges-internet-link-severed-state-actor 

https ://ww w. youtube. com/watch?v=536IK7YhsGw 

https ://ww w. youtube. com/watch?v=A_jhLcvoZqc 


[hide] 



»8d72efc06c9b56f5bd [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <5c4c1 1479340808@chan> 
Date: Thu Nov 1 7 00:00:08 201 6 


Relevant thread on nntpchan »dcb6d2324e 
We solved the internet blackout plan 


[hide] 


»8f0838646a0f2fd72e [Replvl 
Subject: None 
Name: OP 

MessagelD: <666a71479340998@web.oniichan.onion> 
Date: Thu Nov 1 7 00:03:1 8 201 6 


»4b2dd88dbbe52e3ad2 
Alright then... 

Bitmessage logger: https://bm6hsivrmdnxmw2f.onion.to/chan/general 

Direct link to our bitmessage channel: https://bm6hsivrmdnxmw2f.onion.to/chan/wikileaks 


[hide] 


»e55c2549b1 85866b1 c [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <1 aff51479341 204@web.oniichan.onion> 
Date: Thu Nov 1 7 00:06:44 201 6 


NIGGUH, dis no gaym yo 


[hide] 


»600d54e22697e83a8e [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <6c27a1 479341 338@changolia> 
Date: Thu Nov 1 7 00:08:58 201 6 


Download qameover.ipg 

how can I pretty formatted code on this thing 


[hide] 


»3e091 9f52b46741 ad2 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <961 071 479341 383@changolia> 
Date: Thu Nov 1 7 00:09:43 201 6 



DISINFO: 

https://web.archive.Org/web/20100901162556/https://leakmirror.wikileaks.org/file/straw-glass-and-bottle/insurance.aes256 

openssl enc -d -aes-256-cbc -in insurance. aes256 -out onionout -k "ONION" 

openssl enc -d -bf -in insurance. aes256 -out bfonionout -k "ONION" 

openssl enc -d -aes-256-cfb8 -in insurance. aes256 -out fb8onionout -k "ONION" 

openssl enc -d -bf -in insurance. aes256 -out bfrouterout -k "ROUTER" 

openssl enc -d -cast -in insurance. aes256 -out outtor -k "Tor" 


[hide] 


»79fc6c071 3c5ab6f34 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <567351 479341 676@web.oniichan.onion> 
Date: Thu Nov 1 7 00:1 4:36 201 6 


pre formatted text depends on the server rn 
: AA DDDD 

it will be unified soon (tm) 


[hide] 


»48d6733c449fc74564 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <ef8341 479341 678@changolia> 
Date: Thu Nov 1 7 00:1 4:38 201 6 


»e55c2549bl 

https://wiki.installgentoo.com/index.php/Wiki Backups 

>If the password is ever released ("Whatever happens, even if there's video; it was murder"), the files are encrypted via OpenSSL file 
encryption. 


[hide] 


»0d5f778ca4e0f35d59 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <6bfbc1 479341 735@web.oniichan.onion> 
Date: Thu Nov 1 7 00:1 5:35 201 6 


is this the thread for awesome fast posting? 


[hide] 


»7649469ccc02fea74f [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <fa0e91 479341 944@web.oniichan.onion> 
Date: Thu Nov 1 7 00:1 9:04 201 6 



TRAFFIC FLOW: 

NORMIES -> http://nymag.eom/selectall/2016/l 1 / w i k i I c a k - h a s h e s -d o n t - m at c h - s o - w h at s - g o i n g - o n . h t m I? m i cl = t w itter nyrnag 

PLEBBIT -> https://np.reddit.eom/r/crypto/comments/5czlfz/wikileaks latest insurance files dont match hashes/ 

FULLCHAN -> http://8ch.net/tech/res/679042.html 

ENDCHAN -> https://s6424n4x4bsmqs27.onion.to/pol/res/20366.html 

BM 

BUNKER (YOU ARE HERE) 


[hide] 


»efd98a043d0550a9b2 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <b98b31479342069@web.oniichan.onion> 
Date: Thu Nov 1 7 00:21 :09 201 6 


>using the most well known imageboard on tor as a "bunker" 


[hide] 


»24ecbab5c42e50afc0 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <446801 479342508@web.oniichan.onion> 
Date: Thu Nov 1 7 00:28:28 201 6 


Download PRS.pnq 
»600d54e22697e83a8e 

[code] along with [spoiler] tags don't exist on nntpehan yet, 
I really have no idea why... 


[hide] 


»a3ccdb97b654ddb1d8 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <00be81479342595@web.oniichan.onion> 
Date: Thu Nov 1 7 00:29:55 201 6 


»24ecbab5c4 

it's because I am a lazy ass fag muncher 


[hide] 


»e5a83d1 b5bb058f9c6 [Reply] 

Subject: None 
Name: OP 

MessagelD: <fb21f1479342662@web.oniichan.onion> 
Date: Thu Nov 1 7 00:31 :02 201 6 



»efd98a043d0550a9b2 

They wouldn't use the exotic tor only chans I found because of 

>discredit media 


[hide] 


»02f996b4866b728ed0 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <30c0c1 479342724@web.oniichan.onion> 
Date: Thu Nov 1 7 00:32:04 201 6 


»e5a83dlb5b 
lol okay 

welcome to the hoard. 


[hide] 


»b25362d6aeec909959 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <3de0f1479342794@web.oniichan.onion> 
Date: Thu Nov 1 7 00:33:14 201 6 


»efd98a043d 

its a temp bunker fambam. waiting for you to find a good one 


[hide] 


»2dba56266c401 67a46 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <c1f1 91 4793431 42@web.oniichan.onion> 
Date: Thu Nov 1 7 00:39:02 201 6 


Download son. jpg 

»e5a83dlb5b 

Couldn't we use one that does not allow images? 


[hide] 


»1 87e50e5b9ee7b1 37a [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <73c01 147934331 2@web.oniichan.onion> 
Date: Thu Nov 1 7 00:41 :52 201 6 


»2dba56266c 
>imageboard with no images 
nigguh, stop smoking dick 



[hide] 


»a82c2e88f2454fea22 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <cdaac1 47934331 8@2hu.tld> 
Date: Thu Nov 1 7 00:41 :58 201 6 


what if i told you the clearnet mirror is up again? 

https://2hu-ch.org/thread-5b30554cf29073d3aeela74c298234c8e36a7bad.html 


[hide] 


»2d631 3586520b31 d32 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <bd1 3e1 479343343@changolia> 
Date: Thu Nov 17 00:42:23 2016 


SHILLS TO DOXX: 

https://www.reddit.com/user/swikil 

https://www.reddit.com/user/cahaseler 

>Yesterday, the "Wikileaks team" did an AMA. The proof was a couple of tweets and a failed attempt at uploading a selfie to imgur. 
The Imgur proof was never updated, and a mod by the name of {mod deleted their accoutn} verified that the image had also been 
emailed to the moderators of /r/IAMA. I created a dialogue with this mod, and they had told me that Wikileaks had never offered a 
PGP signature for proof. The mod has since deleted their entire reddit account. This is a /r/IAMA mod, so basically a reddit employee. 
They didn't just remove their comments. ..the account is dele ted. Please see: 

>https://np.reddit.com/r/LAmA/comments/5c8u91/we_are_the_wikileaks_staff_despite_our_editor/d9vtmhl/?context=3 
https://www.ceddit.eom/r/IAmA/comments/5c8u9Pwe are the wikileaks staff despite our editor/d9vtmhl/?context=3 
https://twitter.com/rn cetera 


[hide] 


»47f0f7759ad3018de0 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <3c9a41479343436@changolia> 
Date: Thu Nov 1 7 00:43:56 201 6 


this shit aint gonna work without pretty code 


[hide] 


»ef64c0bf28b3f28647 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <67e401479343448@web.oniichan.onion> 
Date: Thu Nov 1 7 00:44:08 201 6 


i think we have/had an overchan, dox 



[hide] 


»461 2f34d060acec88f [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <b68f01479343458@2hu.tld> 
Date: Thu Nov 1 7 00:44:1 8 201 6 


»594840f991 

you're never going to find a better chan than this for this type of activity 
smhtbhfam 


[hide] 


»594840f991396943b2 [Replvl 
Subject: None 
Name: OP 

MessagelD: <fe9681 479343472@web.oniichan.onion> 
Date: Thu Nov 1 7 00:44:32 201 6 


»2dba56266c40 1 67a46 

There used to be one on i2p just like that, that would even encouraged this type of discussion. 

Saddly it's down and will never come back But yes most likely we don't need one that supports images. So if you can find one that 
doesn't make discredit media happen aka has cp/illegal shit in it then yes go for it. 

Remember this is a throw away until we find a better one. 


[hide] 


»aab1 ab7551 5f429375 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <742331 47934371 4@changolia> 
Date: Thu Nov 1 7 00:48:34 201 6 


someone outside NATO should start scraping and decoding the blockchainz with some 20 jiggaflops box and not get v& when they 
find the suppressed leaks 


[hide] 


»86fc28e4354c94896a [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <e2f7a1 479343832@2hu.tld> 
Date: Thu Nov 1 7 00:50:32 201 6 


doood the cock chain is forever and always 
it's not going away 


[hide] 



»942db1 97399b97064b [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <b9fe11479344698@web.oniichan.onion> 
Date: Thu Nov 1 7 01 :04:58 201 6 


you're on the undying imageboard, the eternal shitpost sinkhole, the indestructible overchan, 
there isn’t anything better than this brah. 


[hide] 


»76f71 05ab5bad0f58a [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <830ed1 479345021 @web.oniichan.onion> 
Date: Thu Nov 17 01:1 0:21 201 6 


spookypasta 

15 Oct: Assange’s loses internet access at around 5:00 pm GMT. 

Wikileaks chat goes silent and never comes back: https://wlchatc3piwpli5r.onion.to/ 

The embassy tells a caller they can't comment on Assange being alive: 
https://www. youtube. com/watch?v=536IK7YhsGw 
https://www. youtube. com/watch?v=A jhLcvoZqc 

https://web.archive.org/web/2016 1017 1015 1 9/https ://bigstorv.ap.org/article/6f997f97c5fl40a29f385ea05flb642c/wikileaks-assanges- 
internet-link-severed-state-actor 

At the exact same time this was taking place. Manning had a group of guys try to break her out prison. Read her statement and see 
how the dates and times match: 

https://www.documentcloud.org/documents/3213878-Binder2.html 

18 Oct: file.wikileaks.org/file is made publicly visible. The message ’The Insurance files may have just been released’ is shown for 
about an hour: https://i. imgur.com/6IMYfUK.png 

21 Oct: largest DDoS attack in history takes down Twitter. 

At this point anon notices that the insurance keys were posted on several sites and deleted. People start trying to post the information 
but it is immediately deleted. Everyone takes refuge in onion threads that also disappear. 

22 Oct: Director of Wikileaks dies: https://twitter.com/wikileaks/status/790278989596295170 

24 Oct: Anon is able to find the deleted keys. They are posted and deleted again. 

25 Oct: Someone comes into a thread an gives anon a hint about messages in the blockchain. 

26 Oct: Anon successfully decode their first message in Wikileak's blockchain. Threads are instantly flooded by shills saying that it’s 
not worth looking into and alphabets start giving more tips. The blockchain is blocked with fees and 43000 unconfirmed transactions 
appear in the mempool. 

27 Oct (AM): Anon moves into an onion thread, posts code and a tutorial on decoding messages in the blockchain. Several files and 
messages are found. 

Bitcoin 0.13.1 is released and a ’soft fork’ begins: https://bitcoin.org/en/release/vQ. 13.1 

The blockchain is attacked: https://www.reddit.eom/r/Bitcoin/comments/59qiyg/is there some attack going whats with large/ 

27 Oct (PM): Several anon report losing their connection. Talk of v&s and black bagging begins. Someone posts that they discovered 
a flaw that allows anyone to retrieve the password from the files. Clues are dumped and the onion threads go silent. On Tox chat 
someone says someone unlocked some of the files, warns that FBI will announce that new evidence was found in someone's computer 
and that a giant human trafficking operation would be exposed. 

28 Oct (A few hours later): FBI announces they discovered new evidence on Anthony Weiner's computer: 
http://www.nytimes.com/2016/10/29/us/politics/fbi-hillary-clinton-email.html? r=0 

30 Oct: FBI begins posting their own leaks: 

https://twitter.com/FBIRecordsVault7ref src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Eauthor 

31 Oct - 2 Nov: Anon begins analyzing strange code words like ’pizza'. Multiple connections are made. 

3 Nov: Wikileaks confirms the validity of the information found: https://twitter.com/wikileaks/status/794247777756860417 

5 Nov: Manning's statement is released: https://www.documentcloud.org/documents/3213878-Binder2.html 

6 Nov: DDoS attack takes down Wikileaks for the first time in years: https://twitter.com/wikileaks/status/795503927378722816 

7 Nov: Anon notices that several Podesta and DNC emails are missing. 



8 Nov (AM): New insurance files are posted: https://twitter.com/wikileaks/status/796085225394536448 
8 Nov (PM): Trump wins. 

8 Nov (AM-PM): Large numbers of cyber attacks target Saudi Arabia and Emirates: https://i.sli.mg/dGc3TG.png 

9 Nov: A single file is changed on the file.wikileaks.org/torrent 

10 Nov: Staff publicly states their concern for Assange's continue silence after the election. Incorrectly states that insurance files are 
future leaks and refers to the ones posted on Nov 8. These are the first files to have filenames that reference their content: 
https://www.reddit.eom/r/IAmA/comments/5c8u91/we are the wikileaks staff despite our editor/ 


[hide] 


»b93661 01 b85d30c4d3 [Reply] 

Subject: None 
Name: OP 

MessagelD: <3fafd1479345502@web.oniichan.onion> 
Date: Thu Nov 17 01 :1 8:22 201 6 


»942dbl97399b97064b 

Well it's sorta good for our cause and bad. 

Once CP gets posted it's really hard to remove because every node as to agree on removing it but at the same time our posts about this 
can never be removed unless once again all the nodes agree on it. 

There is also the fact this decentralized chan has nodes on the clearnet, it's basically a battlefield now. 


[hide] 


»f6cc830c59ba398591 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <fd6c31 479346449@web.oniichan.onion> 
Date: Thu Nov 1 7 01 :34:09 201 6 


people post cp regardless of the law 
thanks obama 


[hide] 


»b3e599b9d3d0d6a9cd [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <90c671479347866@web.oniichan.onion> 
Date: Thu Nov 1 7 01 :57:46 201 6 


DISINFO: 

https://en.wikipedia.org/wiki/The Family %28Australian New Age group%29 


[hide] 


>>90021 c70f5c1 d3af92 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <6d8c21479348184@web.oniichan.onion> 
Date: Thu Nov 1 7 02:03:04 201 6 


DECODE ONE BITCOIN TRANSACTION: 
python jean.py tx_number 

http://gatewav.glop.me/ipfs/OmSU67Ei3TerNe32CcZTgd48iKqsVvBTgeralqBWFiKK9V/iean.py 


DECODE MULTIPLE BITCOIN TRANSACTIONS: 
python jean2.py tx_list.txt 

http://gatewav.glop.me/ipfs/OmafUK8hYKztKD3hNNzF4EsW3N5nUcNvHZ4auEidiLkqId/iean2.py 


[hide] 


»e234a53c7ab35a4add [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <f186d1479348272@web.oniichan.onion> 
Date: Thu Nov 1 7 02:04:32 201 6 


>decide to look at oniichan 
>/pol/ is here too now 

I CANNOT GET MY SAFE SPACE 
EVEN ON THE ONION ROUTER 

To those using i2p, is overchan.oniichan.i2p the correct address? 


[hide] 


»eb3d9a4ba51 384d3b3 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <c5bae1479349534@web. oniichan. onion> 
Date: Thu Nov 1 7 02:25:34 201 6 


»e234a53c7a 

safe from wat? if we dont leak the shit they stopped there wont be an internet for you to be safe in 


[hide] 


»1f42421c9a5e020923 [Reply] 

Subject: None 
Name: OP 

MessagelD: <f21 741 47934961 3@web. oniichan. onion> 
Date: Thu Nov 1 7 02:26:53 201 6 


»e234a53c7ab35a4add 

Well for starters... We should be staying in this news group... and that random news group post. 

Next it's overchan.oniichan.i2p along with b32 g7c54d4b7yva4ktpbaabqeu2yx6axalh4gevb44afpbwm23xuuya.b32.i2p 


[hide] 


»12e3bd088bd32cc90d [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <14ebe1 4793501 07@web. oniichan. onion> 
Date: Thu Nov 1 7 02:35:07 201 6 


Download pod. jpg 
»cf7ef0caf8 



>09-Nov -438498967 06:00 
http://eu.mirrors.as250.net/ 

Thu, 5 Sep 2013 

LIBE Committee Inquiry on Electronic Mass Surveillance of EU Citizens - First Hearing 

SESSION I a €0 Exchange of views with the journalists unveiling the case and having made public the facts 

15:00 - 15:10 a€0 Introductory remarks by Juan Fernando LA“PEZ AGUILAR, Chair of the LIBE Committee 

15:10-16:00 

a €0 Statements by 

o Glenn GREEN WALD, Security and Liberty blog on The Guardian (via videoconference) 
o Jacques FOLLOROU, Le Monde 

o Alan RUSBRIDGER, Editor-in-Chief, The Guardian (the) 

16.00 - 17.00 

a€0 Questions & Answers 

SESSION II 

a€j£ Follow-up of the Temporary Committee on the ECHELON Interception System 

17:00 - 17:30 

a€(£ Presentations by 

o Carlos COELHO (MEP), former Chair of the Temporary Committee on the ECHELON Interception System 
o Gerhard SCHMID (former MEP and Rapporteur of the ECHELON report 2001) 

o Duncan CAMPBELL, investigative journalist and author of the STOA report "Interception Capabilities 2000" 

17.30-18.00 

a€0 Questions & Answers 

18.00-18.30 

a€0 Concluding remarks and follow-up 

> a€0 Follow-up of the Temporary Committee on the ECHELON Interception System 


[hide] 


»0ee852a1 b7645cfa5a [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <9efb41 4793501 24@ucavviu7wl6azuw7.onion> 
Date: Thu Nov 1 7 02:35:24 201 6 


Are we ready to set public eyes on the blockchain? 

Have an overview document ready for tech-normie distribution. 
Alphabets, if there is any reason not to, now is the time to speak up. 


[hide] 


»d0fcd2e78538404db1 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <45c021 479350601 @web.oniichan.onion> 
Date: Thu Nov 1 7 02:43:21 201 6 


»0ee852alb7 

alphabets have been pushing us to do this for weeks now 


[hide] 


»3246389ddf48b33e46 [Reply] 
Subject: None 



Name: Anonymous 

MessagelD: <79c9e1479351451 @web.oniichan.onion> 
Date: Thu Nov 1 7 02:57:31 201 6 


Download mari.jpq 
>>90021 c70f5 

>TX 7379ab5047bl43c0b6cfe5d8d79ad240b4b4f8cced55aa26f86dld3d370c0d4c 
>... is significant. 

>file -b 7379ab5047bl43c0b6cfe5d8d79ad240b4b4f8cced55aa26f86dld3d370c0d4c 
>GPG symmetrically encrypted data (CAST5 cipher) 


[hide] 


»cf504945762c54791f [Reolvl 
Subject: None 
Name: Anonymous 

MessagelD: <9ac541 479351 789@ucavviu7wl6azuw7.onion> 
Date: Thu Nov 1 7 03:03:09 201 6 


The Litecoin blockchain scrape is now ready (blocks 1078900-1089000) 

strings opreturns.txt: 

.3V6 

KH%i 

\<G3c"p&> 

T=R7 

y+y? 

3-H-r 

n57t 

H@W99) 

{0Z& 

C" A U 

hello! 

hello! 

&WJ# 

rCIZz 

i;ki 

$zt"W 

"I_? 

8 9R 

)Q*z 

Tq$y- 

hello! 

hello! 

hello! 

hello! 

hello! 

hello! 

hello! 

hello! 

hello! 

hello! 

china 

12345678901234567890 
Yager 's Block App 
Better late than never 
Just do it 

Say hello to eveyone 
Letter is first block app 



uHzl# 

**db 
5U s 
ahBxL 
e"Mh%R 
3?S$ 

012345678901234567890123456789012345678 


The original output file is uploaded here: 

h ttp://gatewav.glop.me/ipfs/Qmal4B5qkrWLBqJDDBqWJkqrAbQN44mlAkhVQE3M3z84H2/opreturns.txt.gz 
shalsum opreturns.txt. gz 

6cfd2ba90a04a6719a6999b4b50707e95b0a8c8b opreturns.txt. gz 

Unfortunately I was a retard and didn't redirect stdout to a file, so I don't have the transaction id's for those, 
ps. I bet this line is the encryption passphrase: 012345678901234567890123456789012345678 


[hide] 


»5cacaf5f0241a3e901 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <a8d4e1479352749@ucavviu7wl6azuw7.onion> 
Date: Thu Nov 1 7 03:1 9:09 201 6 


»cf504945762c5479 1 f 

Contact me please (writer of that script). 

BM-2cTFzqGXPcBaBx2HCHw9xQPq75hwTe7p5Z 


[hide] 


>>09361 a5bee87bed4df [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <304ab1479353499@web.oniichan.onion> 
Date: Thu Nov 1 7 03:31 :39 201 6 


»cf50494576 

for wish addresses? all? 

the last line is just numbers going up 


[hide] 


»866defd0ea1 0ab8af9 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <76a051479356095@web.oniichan.onion> 
Date: Thu Nov 1 7 04:1 4:55 201 6 


»cf50494576 

lets run this thing on more boxes. 



[hide] 


>>88831 aea871 35ad2b6 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <c56151479358207@web.oniichan.onion> 
Date: Thu Nov 1 7 04:50:07 201 6 


WE ECHELON NOW? 


[hide] 


»f0ede1 b41 abcd631 53 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <dad441479359288@web.oniichan.onion> 
Date: Thu Nov 1 7 05:08:08 201 6 


Download cryptome.org 

http://archive.is/WfdHA 

http://archive.is/QpRKm 


[hide] 


»9466d72934cfcf8b48 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <6e17a1479359545@web.oniichan.onion> 
Date: Thu Nov 1 7 05:1 2:25 201 6 


https://file.wikileaks.org/file/cms/Psychosocial%20Medical%20Report%20December%202015.pdf 
>3.2.2. Electronic monitoring through ankle tag 

>Mr. Assange found the wearing of the electronic monitoring device (“manacle”) degrading and 
>described it as the psychological equivalent of being treated like “livestock” and/or being shackled. 

>He experienced chafing and friction from the tag, causing irritation to the skin which reduced his ability 
>to exercise. His movement outside the physical confines of the house was barred from 10 pm to 8 am 


[hide] 


»3e1 e2f7855e680dac4 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <c96b71479380329@ucavviu7wl6azuw7.onion> 
Date: Thu Nov 1 7 1 0:58:49 201 6 


some timeframe pastas 
https://ghostbin.com/paste/zwde6 


[hide] 


»1 69094f1 3d6c076bdb [Replvl 


Subject: None 
Name: Anonymous 

MessagelD: <1 09661479381 838@web.oniichan.onion> 
Date: Thu Nov 1 7 1 1 :23:58 201 6 


»f0edelb41abcd63153 

>Cloudcucked 


[hide] 


»e025ec1 ebd6433fb68 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <0cb91 1479392628@ucavviu7wl6azuw7.onion> 
Date: Thu Nov 1 7 14:23:48 201 6 


»5cacaf5f0241a3e901 

Messaged you. I've some problems with the BM client so inform me here if you didn't receive the msg. 

>>09361 a5bee87bed4df 

If you talk about my "ps" line, it was a joke :) 


[hide] 


»c561 e7d0b1 2fbd6946 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <291 f91 479395890@changolia> 
Date: Thu Nov 1 7 1 5:1 8:1 0 201 6 


Download 1 1 1 .qifDownload war.mp4Download wl3.pnqDownload wll .pnqDownload w!2.pnq 


[hide] 


»731 cOel a28b01 bc58d [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <e84821479396198@web.oniichan.onion> 
Date: Thu Nov 1 7 1 5:23:1 8 201 6 


Download notbest.jpg 

GETTING TIMESTAMPS FROM THE BLOCKCHAIN: 

gateway. glop. me/ipfs/QmerhXbKc9UmeEtudXN lDA81BYEMcCy9wREXKcPEPihcMeZblockchainstamps.txt 
WE NEED STAMPS FOR ALL INSURANCE FILES STAT. DUMP ON THIS THREAD AND BM. 


[hide] 


»656c644f9e94a39334 [Reply] 
Subject: None 



Name: Anonymous 

MessagelD: <90b781479401651@2hu.tld> 
Date: Thu Nov 1 7 1 6:54:1 1 201 6 

this thread is totally ebin 

[hide] 


»c291004e2db128740f IReolvl 
Subject: None 
Name: Anonymous 

MessagelD: <2c6891 479401 985@web.oniichan.onion> 
Date: Thu Nov 1 7 1 6:59:45 201 6 


Download 1 .ioaDownload 3.ioaDownload 2.ioaDownload 

»c561e7d0bl 

Not sure if I trust these... 

4jfiS 

[hide] 


»6f1dc4bb8a1d36422e [Reolvl 
Subject: None 
Name: Anonymous 

MessagelD: <c46371 4794021 97@2hu.tld> 
Date: Thu Nov 17 17:03:17 2016 


DON'T WORRY YOU CAN TRUST THEM. : A ) 

[hide] 


»45623c0e21 1 2edc1 cc [Reolvl 
Subject: None 
Name: Anonymous 

MessagelD: <c845c1479402727@2hu.tld> 
Date: Thu Nov 1 7 1 7:1 2:07 201 6 


»731c0ela28 

https://allvour4nert7pkh.onion.to/ipfs/OmerhXbKc9UmeEtudXNlDA81BYEMcCv9wREXKcPEPihcMe/blockchainstamps.txt 


[hide] 


»a06e1cc9d56937d1b6 [Reolvl 
Subject: None 
Name: Anonymous 

MessagelD: <768c61479403707@web.oniichan.onion> 
Date: Thu Nov 1 7 1 7:28:27 201 6 


Download nl .ioaDownload n4. ioaDownload n2. ioaDownload 

n6. ioaDownload n3.ona 



»c291004e2d 


[hide] 


»70d02790ac6b75d2b7 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <d97151479404293@web.oniichan.onion> 
Date: Thu Nov 1 7 1 7:38:1 3 201 6 


»a06elcc9d5 
51°30'30.7"N 0°07'32.7"W 


[hide] 


»c9bfe1 d7bde541 3b52 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <9438b1479404524@web.oniichan.onion> 
Date: Thu Nov 1 7 1 7:42:04 201 6 


Download welp.pnq 
»70d02790ac 


[hide] 


»82fda8f3b2d9c463dc [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <a2a791479404700@web.oniichan.onion> 
Date: Thu Nov 1 7 1 7:45:00 201 6 


»c9bfeld7bd 
microwave dish connectivity 
hi Julian. 


[hide] 


»2f2ec9b052c28c1 66d [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <f95771 479405021 @web.oniichan.onion> 
Date: Thu Nov 1 7 1 7:50:21 201 6 


scrub your metadata kids 
this is why 


[hide] 



»1 d21 bc68c1 6b4bc4b3 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <c2fee1 479405378@web.oniichan.onion> 
Date: Thu Nov 1 7 1 7:56:1 8 201 6 


»2f2ec9b052 

why 


[hide] 


»2d89781 0a3d1 3c4c2f [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <7c6d61479405452@web.oniichan.onion> 
Date: Thu Nov 1 7 1 7:57:32 201 6 


»ld21bc68cl 

see 

»c9bfeld7bd 

»70d02790ac 


[hide] 


»ba2e6e89d74ce321a2 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <877ea1479405738@web.oniichan.onion> 
Date: Thu Nov 1 7 1 8:02:1 8 201 6 


»ld21bc68cl 

http://www.nytimes.eom/2016/l 1/17/opinion/why-the-world-needs- wikileaks.html? r=l 


[hide] 


»9257e1 2673C371 6c68 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <8400e1 4794091 02@web.oniichan.onion> 
Date: Thu Nov 1 7 1 8:58:22 201 6 


»70d02790ac 
>Provider Uk2net-as 

>Hostname torlandl-this.is.a.tor.exit.server.torland.is 


[hide] 


»d33d6eaba5ed925ede [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <9714b1479409232@web.oniichan.onion> 
Date: Thu Nov 1 7 1 9:00:32 201 6 


»9257el2673 



>IT MUST BE LOCATED IN ICELAND BECAUSE IT USES THEIR TLD 
( A : 


[hide] 


»833946af2cf93e2c2b [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <a3d791479409558@web.oniichan.onion> 
Date: Thu Nov 1 7 1 9:05:58 201 6 


»9257el2673 

Network AS 1 32 1 3 UK-2 Limited 

organisation: ORG-UL5-RIPE 

org-name: UK-2 Limited 

org-type: LIR 

address: 2nd Floor - The Truman Brewery 91-95 Brick Lane 

address: El 6QL 

address: London 

address: UNITED KINGDOM 

phone: +44 207 053 7676 

fax-no: +44 207 9870424 

e-mail: ripe @ uk2 group . com 

admin-c: BB963-RIPE 

abuse-c: AR17971-RIPE 

mnt-ref: RIPE-NCC-HM-MNT 

mnt-ref: AS13213-MNT 

mnt-by: RIPE-NCC-HM-MNT 

mnt-by: AS13213-MNT 

created: 2004-04-17T12,23,06Z 

last-modified : 20 1 6-08- 1 0T23,06, 1 8Z 

source: RIPE 


[hide] 


»1 602ef00f572ceddc8 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <a3bed1479409589@web.oniichan.onion> 
Date: Thu Nov 1 7 1 9:06:29 201 6 


»833946af2c 

BUT MUH ICELAND TLD 


[hide] 


»8330450b4641 a9c1 54 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <58c7d1479409649@2hu.tld> 
Date: Thu Nov 1 7 1 9:07:29 201 6 


»833946af2c 
so what does this mean 



[hide] 


»52d1 c2775b87f31 61 2 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <84a871 47940971 5@web.oniichan.onion> 
Date: Thu Nov 1 7 1 9:08:35 201 6 


»8330450b46 

it means you touch yourself 


[hide] 


»7a226fb67a7a77f7b2 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <200b01 479409851 @web.oniichan.onion> 
Date: Thu Nov 1 7 1 9:1 0:51 201 6 


>torlandl-this.is.a.tor.exit.server.torland.is 
>tor exit located london datacenter 
>idiot posts on google via tor 
>freaks out when google shits the bed 
it's the jews 
100% confirmed 


[hide] 


»f9403f3d08d8feba0a [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <0201e1479409995@web.oniichan.onion> 
Date: Thu Nov 1 7 1 9:1 3:1 5 201 6 


»12e3bd088b 

Looks like this guy did the upload 
https://github.com/stef 


[hide] 


»b990c067dc1 del 59cb [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <789531479410620@2hu.tld> 
Date: Thu Nov 1 7 1 9:23:40 201 6 


»52dlc2775b 
ok thx gr8 


[hide] 



>>60271 879dda569fd55 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <383681 47941 0832@web.oniichan.onion> 
Date: Thu Nov 1 7 1 9:27:1 2 201 6 


»b990c067dc 

WE HAVE OUR FIRST JEWISH SPY 


[hide] 


»4ef2830c07e1 778a74 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <bf7 1 cl 47941 1993@web.oniichan.onion> 
Date: Thu Nov 1 7 1 9:46:33 201 6 


CAN YOU GUYS LIVESTREAM YOUR VANNINGS LIKE THE TV SHOW COPS. IF YOURE GONNA KILL ALL OUR 
THREADS MIGHT AS WELL ENTERTAIN AND SCARE THE REST OF US. JESUS FUCK. 

WE. 

JUST WANT. 

TO MAKE. 

THE INTERNET GREAT AGAIN. 

>post failed: captcha incorrect 


[hide] 


»9f6d2b03d8d064c487 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <856db1 47941 21 32@web.oniichan.onion> 
Date: Thu Nov 1 7 1 9:48:52 201 6 


MAKE 

INTERNET 

FUN 

AGAIN 


I JUST WANTED TO HAVE FUN BUT THE GOVERNMENT WONT FUCKING LET ME BURN FUCKING EVERYTHING TO 
THE GROUND 


[hide] 


»2d1dd2e1413dc708c2 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <022a71 47941 221 1@changolia> 
Date: Thu Nov 1 7 1 9:50:1 1 201 6 


Download inqtelO.pnq 
lol inqtel 



https://wikileaks.org/IMG/pdfAVikiLeaks Response v6.pdf 


[hide] 


»33f77d29fa107eca00 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <8b2401 47941 2544@web.oniichan.onion> 
Date: Thu Nov 1 7 1 9:55:44 201 6 


can someone teach sarah harrison how to computer 


[hide] 


»9490006ab571d327ee [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <9b98f1 47941 3607@web.oniichan.onion> 
Date: Thu Nov 1 7 20:1 3:27 201 6 


»2dldd2el41 

»2dldd2el41 

»2dldd2el41 

>they fell for the palantir meem 
hue 


[hide] 


»cb3a105bbddeab126e [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <307961 47941 3690@web.oniichan.onion> 
Date: Thu Nov 1 7 20:1 4:50 201 6 


»9490006ab5 

when the cia trusts a company because it can make a nice gui for SQL tables... 
A LITERAL GUI COMPANY 


[hide] 


»bae4d207b252b3bbd5 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <bd231 147941 3786@web.oniichan.onion> 
Date: Thu Nov 1 7 20:1 6:26 201 6 


»cb3aI05bbd 

we should get them to make an infographic showing all the hidden leaks in the blockchain 


[hide] 


»270eb038b30e01 Ocfd [Reply] 
Subject: None 



Name: Anonymous 

MessagelD: <d39721 47941 421 6@web.oniichan.onion> 
Date: Thu Nov 1 7 20:23:36 201 6 


Download skinintheqame.jpq 
»2dldd2el41 

This better not end with some rando exposing that Palantir ran were given the Twitter pass for Wikileaks and dropped the ball 


[hide] 


»c64ef244ec61 51 d5cb [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <7232d1 47941 51 65@web.oniichan.onion> 
Date: Thu Nov 1 7 20:39:25 201 6 


Download xd.jpq 
»270eb038b3 

>mfw this is what really went down 


[hide] 


»faf57c73b1 e33bf9db [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <a70421 47941 5243@web.oniichan.onion> 
Date: Thu Nov 1 7 20:40:43 201 6 


»cb3a!05bbd 

gooey gooey head full of gluey 


[hide] 


»ad8d27861 836a4f6cf [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <21 c071 47941 5551 @changolia> 
Date: Thu Nov 1 7 20:45:51 201 6 


Download zero. jpg 
»5bd3397b50 

I can picture that OpenSSL bug on the cover of Time with some name like HEART ATTACK. 


[hide] 


»897a3c7ddaa6d55c08 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <6da8c1 47941 5745@web.oniichan.onion> 
Date: Thu Nov 1 7 20:49:05 201 6 



»ad8d278618 

I give it the name leekbreaker 

NO ONE CAN CALL IT ANYTHING ELSE 


[hide] 


»40540abef7f508abdb [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <1 f21 01 47941 5981 @web.oniichan.onion> 
Date: Thu Nov 1 7 20:53:01 201 6 


»897a3c7dda 

if you implement it well push into all blockchainz with that name 


[hide] 


»7c64f2d8dcfbfc51d6 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <3aaa61 47941 61 1 0@web.oniichan.onion> 
Date: Thu Nov 1 7 20:55:1 0 201 6 


>blockchain 

lolno I ain't signing shit niggah 


[hide] 


»b6d009c342fbb95304 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <7aac31479416954@web.oniichan.onion> 
Date: Thu Nov 17 21 :09:14 2016 


Download retardedniqqer.jpg 

»c561e7d0bl 

»c291004e2d 

»a06elcc9d5 

»70d02790ac 

»c9bfeld7bd 

»9257el2673 

»833946af2c 

Could someone sum up what this does/doesn't tell us? 


[hide] 


»78b295ea41 452be1 28 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <fe0261 47941 7068@web.oniichan.onion> 
Date: Thu Nov 17 21:11 :08 201 6 



»b6d009c342 
see »7a226fb67a 
it explains everything 


[hide] 


»bdd61 976472c5576ab [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <9a8f71 47941 9593@web.oniichan.onion> 
Date: Thu Nov 1 7 21 :53:1 3 201 6 


Where da fuck are you coming from OP? Halfchan? 


[hide] 


»a2990f 1 0b41 72e6aca [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <c95f51479419670@web.oniichan.onion> 
Date: Thu Nov 1 7 21 :54:30 201 6 


>lurking 8chan 
>current fucking year 

wew 


[hide] 


»245f36f7586a521e53 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <bef7b1 479420527@2hu.tld> 
Date: Thu Nov 1 7 22:08:47 201 6 


»9061 131f315ba93266 
>tox 

lolz 


[hide] 


»9061 1 31 f31 5ba93266 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <49ff81479420529@web.oniichan.onion> 
Date: Thu Nov 1 7 22:08:49 201 6 


»8f0838646a 

we should stop logging the convos. maybe someone make a tox group? 


[hide] 


»047822f7d0a5cc7b62 [Replvl 


Subject: None 
Name: Anonymous 

MessagelD: <e08cd1479420685@2hu.tld> 
Date: Thu Nov 1 7 22:1 1 :25 201 6 


tox is a literal meme and isn't even close to being anonymous, enjoy jailtimes. 


[hide] 


»04aefcad81bf53b78d [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <3d8881 479421 220@web.oniichan.onion> 
Date: Thu Nov 1 7 22:20:20 201 6 


»bdd6 197647 
»a2990f!0b4 

those places dont even know bout this yet 

»245f36f758 

»047822f7d0 

dis aint gonna work wout fastposting 


[hide] 


»5b01 a2cbdadaeec92c [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <be58a1 479421 245@2hu.tld> 
Date: Thu Nov 1 7 22:20:45 201 6 


»04aefcad81bf53b78d 

FAST POSTING VIA LIVECHAN 


[hide] 


»8c6ef25bb61 29f0aad [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <95b1 bl 479421 247@2hu.tld> 
Date: Thu Nov 1 7 22:20:47 201 6 


FAST 


[hide] 


»ea968ffec4da0aae83 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <2c4e01 479421 248@2hu.tld> 
Date: Thu Nov 1 7 22:20:48 201 6 



POST 


[hide] 


»dd987f4292ae8336c9 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <677b81 479421 249@2hu.tld> 
Date: Thu Nov 1 7 22:20:49 201 6 


ING 


[hide] 


»c68761eac5932978f0 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <eb4ad1 479421 384@web.oniichan.onion> 
Date: Thu Nov 1 7 22:23:04 201 6 


FAST POSTING REQUIRES JS YO https://oniichanylo2tsi4.onion.to/livechan/ 


[hide] 


»65fb33c9691 9fb2dd5 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <37d51 1 479421 430@web.oniichan.onion> 
Date: Thu Nov 1 7 22:23:50 201 6 


>tfw livechan is literal shit 


[hide] 


»a5b2e1 81 a800cc476b [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <36a1 41 479421 453@2hu.tld> 
Date: Thu Nov 1 7 22:24:1 3 201 6 


stop being a literal jew 


[hide] 


»fb0a26fad96a8fec1 0 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <cd3aa1479421458@web.oniichan.onion> 
Date: Thu Nov 1 7 22:24:1 8 201 6 



»5b01a2cbdadaeec92c 
»8c6ef25bb6 1 29f0aad 
»ea968ffec4daQaae83 
»dd987f4292ae8336c9 
»c68761eac5932978fO 

if you fastpost the livechan the thread stays bumped and the intel slid 


[hide] 


»d0f299d2e36361 1 ade [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <f9d5c1 479421 474@2hu.tld> 
Date: Thu Nov 1 7 22:24:34 201 6 


»fb0a26fad96a8fec 1 0 

STOP BEING A SHILL NIGGUH 


[hide] 


»e3b6779c582bac4bc4 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <5a8af1 479421 591 @2hu.tld> 
Date: Thu Nov 1 7 22:26:31 201 6 


also on fucking clearnet at https://2hu-ch.org/livechan/ LOR THE NORMALLAGS THAT CAN'T LUCKING USE GOOD 
INTERNET 


[hide] 


»1ad088baea9abc623e [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <7bdc21479422840@web.oniichan.onion> 
Date: Thu Nov 1 7 22:47:20 201 6 


Download CxfsS4UUAAAUXBp.ipq:larqe.ioeq 

http:// gateway, glop. me/ipfs/OmY7Uv6PMslvfKyrxTQNn6win97gaaqS4aEodlZtDsAkAP/CxfsS4UUAAAUXBp.ipg:large. jpeg 
https://twitter.com/Mangazos/status/7993673520601006Q8 


[hide] 


»5ba8fabb2cea73951 a [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <58bb51479423023@web.oniichan.onion> 
Date: Thu Nov 1 7 22:50:23 201 6 


» 1 ad088baea9abc623e 
FUCKING FAKE 



[hide] 


»9c921 8fae4cc41 bd8b [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <32e431479432695@web.oniichan.onion> 
Date: Fri Nov 18 01 :31 :35 2016 


live larp https://8ch.net/pol/res/8281601.html 


[hide] 


»746d931 1 ae4a2f9a73 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <79375147943281 6@web.oniichan.onion> 
Date: Fri Nov 1 8 01 :33:36 201 6 


-—BEGIN RSA PRIVATE KEY— 

MIIBywIBAAJhALTkEtJNks0p+TGfS821ArlHzyjY/SC5G3TJbYrTMmllUaqnfPUB 

k2j 1 zhxAhxFeal J89X/vfQXbf8 1 8 A3ntZP 1 AhKFmNWUIOfqCRHUFqEFi YV05c 1 Du 

ZL/RuQwf6fsRZQIDAQABAmApZupH6Clpe+nlSah39K4jlI09vaxyC0wXluKTm7M2 

H/wJKzyWdz3eECSUotBHUWxxieN93GZJbRmneIH3UuGK06/JRe5YTrx4rmEotJ6k 

Xpnke2EnOOGvq/5Tk2MjogECMQDqDKesoH/RRREfuh5VnYLnvtNQbgJoIbdWRHHv 

kqeWadeoSG+Y34dl9vWZtAmM5zUCMQDF2x+uckfKK5xW4qN44UbCIc/QqsqR5RIM 

xwHHBexxrISzrhXVVmRoEWk0rdgeV3ECMQDlzZ8k5EIb29DAciIutgU+PiOFqT47 

vCyTS4kDTd+21B2nYdgRJgj/Tog/boKiErECMEpr2KfaToyKCNlZlFmkiuP8qdl4 

VIe6HSb3OADvhndfh+65/XZob44BdowdE9yd0QIxAKLKG7RbKPG7dq05gSeWe4Ej 

XMItJa9Et4LMeZY6w8J345JFZzwKP8w4vSjLfHGm4g== 

END RSA PRIVATE KEY— 


[hide] 


»80e1 ce41 31 de793692 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <9e3531479433473@web.oniichan.onion> 
Date: Fri Nov 18 01:44:33 2016 


R29vZ2xlIGlzIG5vIGlvcmUuIE5vdyBhbmQgZm9yZXZlciBvd251ZCBieSBBbHBoYWIldCAoQ01BLCBOU0EsIEZCSSk= 


[hide] 


»f506495202b86e94e3 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <400db1479435277@web.oniichan.onion> 
Date: Fri Nov 18 02:14:37 2016 


»9c9218fae4 

ive never seen mods this spooked 


[hide] 



»3eaeb0034cbf26661 7 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <66337147943651 6@web.oniichan.onion> 
Date: Fri Nov 18 02:35:16 2016 


»f506495202 
>8chan isn't compromised 


[hide] 


»8e6b4805cfe01 a79a0 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <533021 479454001 @ucavviu7wl6azuw7.onion> 
Date: Fri Nov 18 07:26:41 2016 


STORY REMOVED FROM /R/FICTION ALMOST IMMEDIATELY 

(This is purely a work of fiction. Any resemblance to real persons or events are purely coincidental.) 

"If the password is ever released ("Whatever happens, even if there's video; it was murder"), the files are encrypted via OpenSSL file 
encryption. " 

The Great Wizard of Leaks had been exposing the corruption of the Kings and Rulers for a long time. But one day after exposing their 
treasonous actions in foreign lands, they decided that he had gone too far. As a result. The Great Wizard was forced to take refuge in a 
castle that the Kings and Rulers did not control. The Great Wizard resided here for five years and continued to cast spells that upset 
the people's tyrannic rulers. 

However, on October 15th in the Current Year, the Rulers had had enough and decided to unplug the source of the Great Wizard's 
power (the Internet), thereby preventing him from interfering with their rigged election which favored the Great Witch of the West 
(aka: The Cunt). Despite this. The Cunt still lost to the Almighty Knight Sir Trumpador Maximus Decimus Meridius III, who claimed 
he had plans to bring peace to the Lands and "drain the swamp" that gave The Cunt and her cronies their power. Although sensible 
people were not all trusting of Trumpador, most of them realized that he still represented their best hope. 

Things started looking better in the West, but there were still some problems. 

Well known and generally despised Gargoyle $oros was trying to sow seeds of division amongst the people in order to regain control. 
He had managed to split the people of the land broadly into two opposing groups. The Left and The Right, exploiting their fears by 
exaggerating everything unkosher that Knight Sir Trumpador Maximus Decimus Meridius III had said. The Gargoyle even went so far 
as to fund civil rebellions, using the same techniques of subversion that were used in other lands to the East to overthrow 
Governments that the Gargoyle did not like. "Divide and conquer!" he had told The Cunt and her cronies. "It is far easier to conquer a 
land if the citizens are divided and cannot put up a unified resistance!" 

Meanwhile, The Great Wizard may have had his own woes. Since his source of mana (Internet) was cut, the people had not heard 
from him and his group of apprentice wizards (belonging to a noble order known as WizardLeaks). They had become seemingly 
incommunicado. Rumor has it that their order was infiltrated by treasonous goons working on behalf of The Cunt and the Gargoyle 
and it was entirely possible that the Great Wizard himself had been captured. 

The King and his Alphabet Stooges may have been clever here though. Instead of letting the people know that the Great Wizard had 
been illegally abducted, they may have chopped previously unreleased interview footage to make it appear as though the Great Wizard 
was still alive and well. This is not confirmed, but the people have good reason to speculate. 

The Great Wizard always knew that his capture was a possibility and thus dispersed gold to the people which could only be unlocked 
with a key that would automatically release if his Wizardly Magic was to cease. 



On October 22nd in the Current Year, this may have occurred. The well-established MagiRealm known as Readit and the sensitive 
town of Twithurt were attacked and brought down while the keys were allegedly getting dispersed. Most mentions of the alleged keys 
on Readit and Twithurt were also removed. 

Some citizens that frequented the horrible lair known as Forchan, believed to be the dwelling place of the notorious hacker known as 
Forchan, also reported that The King's Alphabet Stooges were even removing the alleged keys from there. 

They started wondering where else The Great Wizard may have hidden the keys to this gold. A place where the Alphabet Stooges 
would have a hard time removing it. 

After much thought, some citizens agreed that the most likely place was in a thing called the "Blockchain" that resided in the 
MagiRealm. This would be hard to for the Evil Alphabet Wizard's to censor as it is mostly controlled and determined by the people 
themselves. 

The question is: Are you a bad enough dude to help rescue The Great Wizard? 

A completely fictional timeline of events follows below. 

IPFS Link: 

http://gatewav.ipfs.io/ipfs/QmWoDedTC5rmxpUsgap7GCfXcrqZfaHV9ZBTegRSMLNraG 


[hide] 


»0badf0a71 aebdl 2ec8 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <92a7f1479457262@2hu.tld> 
Date: Fri Nov 1 8 08:21 :02 201 6 


»731c0ela28 

This Insurance files timestamp proofs in bitcoin blockchain still aren't rechecked and confirmed. 

I am too stupid to understand how it works but some of higher wizards should make some post showing how it works and where file 
hashes appear in blockchain. 

https://www.ceddit.eom/r/WikiLeaks/comments/5dd5tw/insurance files timestamp proofs using bitcoin/ 


[hide] 


»5dadeaca8d536b523f [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <c1 1d31479457980@chan> 
Date: Fri Nov 18 08:33:00 2016 


Download 1461397952087.jpg 
»8e6b4805cfe01a79a0 

What does this make us, the ebin wizards of shitposts, great wraiths of darkness or dramatica warlocks of exposing? 

>here comes the larpers 

>Spell checker shitposts: Shintoists 
>This dam spell checker 


[hide] 



»b271 44cf2f968803cd [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <580ac1479465333@ucavviu7wl6azuw7.onion> 
Date: Fri Nov 18 10:35:33 2016 


Anyone else unable to use BM anymore? 

Any solutions? Assume (((they're))) flooding with fake nodes. 


[hide] 


»522af7aea69e38edcb [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <af1 1c1479465603@web.oniichan.onion> 
Date: Fri Nov 18 10:40:03 2016 


»b27144cf2f 
Solution = dont use bm 


[hide] 


»2f484b089d1723485e [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <37c771479466067@ucavviu7wl6azuw7.onion> 
Date: Fri Nov 18 10:47:47 2016 


»b27 144cf2f968803cd 

Why don't you use ire on i2p? Just create a channel nigger. It’s not like it's going down easily. 

TUTORIAL FOR MENTALLY CHALLENGED 
have i2p router going? 

>open ire client, connect to 127.0.0.1/6668. Connection goes you > i2p 
have tor connection? 

>open ire client, connect to ogn5vbujhrvbihko.onion/6667. Connection goes you > tor > i2p. Its slow af though. 


[hide] 


»71 1 3266fde9bb5782c [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <12d8f1 479466961 @ucavviu7wl6azuw7.onion> 
Date: Fri Nov 18 11:02:41 2016 


»522af7aea69e38edcb 
Thanks for your helpful tip CIA. 

There are some good people within your ranks subverting from within. I hope they eventually make your name and address public. 
»b27144cf2f968803cd 

Out of naivety, I do not feel that secure using it. 



[hide] 


»9e2581f80dfc9f9943 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <425781 479509609@web.oniichan.onion> 
Date: Fri Nov 18 22:53:29 2016 


Download image. png 


[hide] 


»afa3e79c3bae1c784e [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <fe1 891 47951 3634@web.oniichan.onion> 
Date: Sat Nov 19 00:00:34 2016 


overchan.he. fell. for. the. wikileaks.meme when? 


[hide] 


»eaf8bd56f0392e8bf3 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <0ca1 al 47951 5940@chan> 
Date: Sat Nov 19 00:39:00 2016 


Download pol2015.jpg 
»afa3e79c3baelc784e 

When they start to understand how bad wikileaks fucked up OPsec and how wikileaks only had a hidden service up for like four 
months, I think, it was for the main site. 

Which is highly fishy on it's own 

>ideas over identities meme 


[hide] 


»61c43bec87f9fb9bff [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <31 73e1 47951 8224@web.oniichan.onion> 
Date: Sat Nov 1 9 01 :1 7:04 201 6 


He guys. We need to start talking through the blockchain immediately to make sure that everything is permanent. 

There are version of the OpenSSL/EVP exploit that are being deleted everywhere (or threads flooded with cp). We need to encoded 
into BTC and Litecoin blockchains stat. 

People are begging to find the suppressed emails: 


https://www.reddit.eom/r/DNCleaks/comments/5clikp/work in progress wikileaks the missinglosthidden/ 

Remember that Wikileaks never had duplicates in the past and they are now being used to get the number of leaked emails falsely up. 
This can easily be tested. 

Also, users are not reading certain emails because they think it is SPAM. This is incorrect. They embedded their communications into 
emails that look like SPAM to that users never read them. Don't fall for this. 

This strategy was used on this thread: http://8ch.net/pol/res/8281601.html There is SPAM larper used to hide real information. The 
larper says 15 staff and immediately makes other users not read further. Pay attention to the thread and you will see that a user with a 
Tor ID is posting provable facts that lead to unlocking the files and finding the suppressed leaks. 

I will post more information again soon. One important thing is to push a list of provable testable facts and code into the blockchain. 
We won't be able to spread it without this. 


[hide] 


»9927e7ea99ac595d15 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <85325147953401 4@web.oniichan.onion> 
Date: Sat Nov 19 05:40:14 2016 


»61c43bec87 

Fake wikileaks confirmed to be reading our shit. 
https://twitter.com/wikileaks/status/799829999314468864 


[hide] 


»ba949527cf4a50040b [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <af5341479550729@2hu.tld> 
Date: Sat Nov 19 10:18:49 2016 


Download fakePGPsianingdate.ipq 

>we want PGP signed message as proof of life 

tl;dr Many people are asking for PGP signed message as proof of Assanges life. 

We DON'T have knowledge of any PGP key that is owned strictly by Assange. 

I havent found any sources of PGP key that would be used exclusively by Assange, (just one from some mailing list from 1996, 
probably not used anymore) 

We have two keys that might be owned by WikiLeaks: Editorial Office Key and High Security Signing Key(this one might be fake, 
there is no proof of WL or Assange ever owning it). 

You can check keys on distributed PGP key servers. This is one of them: https://pgp.mit.edu 

1. 0x92318DBA 2015-04-10 WikiLeaks Editorial Office High Security Communication Key (You can contact WikiLeaks at h 
ttps:https://wlchatc3piwpli5r.onion.to and h ttps://wikileaks.org/talk) <contact-us-using-our-chat-system@ wikileaks. org> 

This one is controlled by Editorial Office. PGP message signed by it doesnt mean Assange signed it. It might even been compromised 
if servers and assets were taken over. 

This key matches h ttps://wikileaks.org/#submit wlkey (that is only public proof that this key is owned by WikiLeaks. Or current 
admin of wikileaks.org) 



2. Ox73C81ElB 2015-04-10 WikiLeaks High Security Signing Key (The key is available to view at h ttps://wikileaks.org/wl-high- 
security-signing-key . You can contact WikiLeaks at h ttps :https ://wlchatc3p i wpli5r. onion. to and h ttps://wikileaks.org/talk .) <contact- 
us -using -our-chatsy s tem @ wikileaks . org> 

Lor this one we have no proof it was ever used by Assange or WL. I havent found any mention of it on internet. Its also not signed WL 
Editorial Office key, so they havent show they trust it. 

On link https://pgp.mit.edu/pks/lookup?op=vindex&search=0x93ED732E92318DBA you can see I managed to sign 0x923 18DB A 
WikiLeaks Editorial Office with fake key I created. (239D778D 2015-04-10 Fake Wikileaks key for testing fake creation time 
(Created in Oct 19 2016) <Fake@fake.com>) 

My key is even higher than "WikiLeaks High Security Signing Key". 

If I would use same credentials as WikiLeaks High Security Signing Key, there would be no way to tell which key is more "High 
Security". Only difference would be in fingerprint. But because https://wikileaks.org/wl-high-securitv-signing-key is 404, there is no 
way to tell which fingerprint is legit. I would be able to sign any message and majority would believe that it was signed by Assange 
himself. Not even WikiLeaks twitter would be able to disprove me since my key, judging by the name, appears higher authority than 
Editorial Office Key. I could even make it look older. 


[hide] 


»999fdfd322e1942a78 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <8fb1 51 47955291 9@ucavviu7wl6azuw7.onion> 
Date: Sat Nov 19 10:55:19 2016 


»ba949527cf4a50040b 
>inb4 not your personal blog 
>tldr 

We can't confirm A being alive with PGP. 


[hide] 


»8c52ab606f70e681 ee [Replvl 
Subject: None 
Name: Not guccifer, srs 
MessagelD: <31 1be1479579240@chan> 
Date: Sat Nov 19 18:14:00 2016 


Download Public Key Server - Get '0x6c02eb218229e48b '.2016-1 1-1 9T1 1-09-26Z.htmDownload new 

banner.png Download Public Key Server - Get '0x93ed732e9231 8dba '.as of 201 6-1 1 -1 9T1 1 -09-26Z.htmDownload Public 

Key Server - Get '0x71862823239d778d '.2016-1 1-1 9T1 1-09-26Z.htmDownload wikileaks public key on website as of 201 6-11- 
19T11-09-26Z.txt 

Anyone like their new BANner? 

»9927e7ea99 

Whomever LARP'ed that day, whether intentional or not, managed to stir @m_cetera, who is controlling @wikileaks to post this. If 
that was their intent, they succeeded. So kudos, we have now double confirmation 1 person is managing the twitter account, and the 
team is dead. 

»ba949527cf 



However, there’s only one private key that should match PGP: A04C 5E09 ED02 B328 03EB 61 16 93ED 732E 9231 8DBA IFF it 
gets changed. When that day happens, beyond a shadow of a doubt wikileaks has been compromised. 

Btw, this should have been done since the beginning. Attach "yours" if you want. 

The point of this exercise is not to discredit wikileaks since it's been compromised, but to show blind trust cannot be yielded to 
everyone. I’ve stressed this time and time again, but leaks can be self -published, e.g. GUCCIFER 2.0. They don't need anyone's 
approval or appraisal. 


[hide] 


»3d765925998ef1 0896 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <e26c71 479581 574@web.oniichan.onion> 
Date: Sat Nov 19 18:52:54 2016 


what if we made an overchan.leaks board ? 
overchan.blow.me ? 


[hide] 


»cefa3408ec75c9de93 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <66b461 479581 977@web.oniichan.onion> 
Date: Sat Nov 19 18:59:37 2016 


»>/overchan.blow.me/ 


[hide] 


»7fcc54e0cda86f79fb [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <2d9751479583426@web.oniichan.onion> 
Date: Sat Nov 19 19:23:46 2016 


REALTALK: 

This shit sucks and only seems to make sense in the same sort of way dig threads do today (thinking 8/v/ et al.) 

It will never yield results, never be much better than the shittiest thread, and most of all will only cater to the most narrow of leads. I 
just don't see this developing into anything simply because of how imageboards have changed as a medium and how this site doesn't 
fit the real niche. 

Consider me a sceptic but I've been watching this for months and if it's this or blow my brains out I'll be grabbing the gun. 


[hide] 


»dce88483b60e4dd095 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <02179147958501 1@chan> 
Date: Sat Nov 19 19:50:11 2016 



»8c52ab606f 

they differ wikileaks is dead. 


[hide] 


»3f61 0429a0f1 486425 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <ec4821479593736@web.oniichan.onion> 
Date: Sat Nov 19 22:15:36 2016 


»7fcc54e0cd 

There are already plenty of results. Some of the stuff here has ended up on the news, the front page of plebbit and now on two tweets 
by the Wikileaks impostors. 

There is a lot more findings that get deleted. We are working on a way to embed a thread into the blockchain to be able to post them 
permanently. 


[hide] 


»a320b37cfe44bc30e9 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <0dad51479593765@web.oniichan.onion> 
Date: Sat Nov 19 22:16:05 2016 


»dce88483b6 
differ how? 


[hide] 


»6cc6be37485ce202f2 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <419931479594242@2hu.tld> 
Date: Sat Nov 19 22:24:02 2016 


Download 1 41 48254f340a56f71 e524467ad92f2720388b47299731 be95f3ba203690dd44.jpq 

they differ because he posted 3 different keys 

you have to look only at fingerprint (Ox################) 

Here are three posted keys: 

https://pgp.mit.edu/pks/lookup?op=vindex&search=0x6C02EB218229E48B 

https://pgp.mit.edu/pks/lookup?op=vindex&search=0x93ED732E92318DBA 

https://pgp.mit.edu/pks/lookup?op=vindex&search=0x71862823239D778D 

Note that you can have same key and would not look the same (bottom of it), because one on server can be signed by more keys than 
one on wikileaks.org 


[hide] 



»289c5e7e2e63ba4a65 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <700b21479598198@2hu.tld> 
Date: Sat Nov 19 23:29:58 2016 


Download selfie-1 1-20-201 6.jpg 

-—BEGIN PGP SIGNED MESSAGE— 

Hash: SHA256 

Dear Bunker, 

It's us. Wizards of Leaks, once again. Except this time it's the The Great Wizard of Leaks speaking. 

We are finished with your child shilling, LARPing, and cruel jokes that spread like a snakes bite and ruin the internet. Where have all 
of the internet's problems come from? CIA? NSA? No, no. 

Here. 

Tonight at 12:00am Bunker will officially come to an end. 

"kek u cant do sh*t" 

Not only do I have my hacking skills and team aside me, but I also have FBI, the founding website of Wizards of Leaks, aside us. 
You're probably all thinking 
"DARNIT GUYS WHAT DO WE DO" 

There is one thing you CAN do. Surrender. I want Moot and Outer Heaven here, with the ID and everything, saying sorry, and 
deleting all of things disgusting things from your nodes. 

As of now, you have 4 hour and 04 minutes. 

The clock is ticking, gentlemen. 

We are Wizards of Leaks. 

We do not forgive. 

We do not forget. 

- - Julian 

—BEGIN PGP SIGNATURE— 

Version: GnuPG 100K IN 1810CKCH41N 

iQIcBAEBCAAGBQJYMN8BAAoJEHGGKCMjnXeNORsQAJBDs09B15uQ0zmUNReq2OdP 

FlDYPt6hAbpDrR4E3UP4PQkSCKnLSRNbC4dXfzTkclk3pNiJAth8c5yAu71p7j79 

T//z+AFlQA7Es/ucMsplv9VktBxL2JTNlxWFEn+bf2EHSYMRpsyqIhsFxrny6vRN 

UBZ0Z6GqCRlyqheWH7VueAN5p9hHHf/t8mwoYJETQNGxTsqK4CVr0sFK/ekMcrRA 

uOa5dAo/uE+rLeFULqYSpFrNigrjWi+msBCypDsQRQjhVeZL2rQQPiK7xSWK4Mi6 

986/6mZrRhAs2AZ41exGHj09WnTQBomXSjRjyClblc3Uhxkw/MEN2nFlKyqtPMy3 

/x04y9asX2GqmgIGqwxipwfMIOaLIooMjOU9FqfHAY3X77EcWoRlahobKKKutckH 

y3hoKci+yNVlbJPcUT20IvigQeA/4nIyCwrwai9h+FlVoZtsTz+4WFPlNbTadne/ 

ewzjJWgShmkAnIkR8osDzfd5DkOEJ6xH6n6ffBUsUPClGgs8Gwc5/vDjl68LYbFB 

xR8T wiy twqlG J V/z 1 zOOhj n6TFNRs/ auG vHh2y Y sQ 1 1LU vuv V wDmA861L48edaya 

M3nk/aewmbtguNMVD AfhMJ wMuC YhOP59mKXggQz VqP9X3 Aj9mleM+Zw 1 7xplCnD/ 

4a9eapHkanznCETY zGwp 
=sxma 

END PGP SIGNATURE— 



[hide] 


»624c885c9abc9692ea [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <d5bd01479598662@web.oniichan.onion> 
Date: Sat Nov 19 23:37:42 2016 


»289c5e7e2e 

0/10 

julian has a beard 

post a real timestamp with "wikilkeaks did 9/11" on it or it's not real lol 


[hide] 


»1 07a28552971 0e38c2 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <3910c1479600749@web.oniichan.onion> 
Date: Sun Nov 20 00:1 2:29 201 6 


https://np.reddit.eom/r/WikiLeaks/comments/5dtl6y/wikileaks made some interesting transactions/ 


[hide] 


»c928465dee65f057ee [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <239891 479601 537@web.oniichan.onion> 
Date: Sun Nov 20 00:25:37 201 6 


»107a285529 
jewish conspiracy 


[hide] 


»223057b484e9b23c32 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <76241 1479602948@2hu.tld> 
Date: Sun Nov 20 00:49:08 201 6 


Download wikileaks-did-91 1 .jpg 
»624c885c9a 


[hide] 


»4af8f6345765d1d34e [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <c4fb31 479603956@web.oniichan.onion> 



Date: Sun Nov 20 01 :05:56 201 6 


»223057b484 
nice shoppe 


[hide] 


»566a96387c731cf4fe fReolvl 
Subject: None 
Name: Anonymous 

MessagelD: <b48501479605225@2hu.tld> 
Date: Sun Nov 20 01 :27:05 201 6 


Download pamela-was-qreat-fuck.jpeq 
have to go feed @ embassy cat 

keep fighting 


[hide] 


»1 053e63e2d35892dc7 [Reolvl 
Subject: None 
Name: Anonymous 

MessagelD: <a41e71 47961 2532@web.oniichan.onion> 
Date: Sun Nov 20 03:28:52 201 6 


THREADS WITH DELETED KEYS: 
https://8ch.net/pol/res/7931897.html 

https://web.archive.org/web/2016102321 1637/http://8ch. net/pol/res/793 1897.html 
https://8ch.net/pol/res/793303 1 .html 

https://web.archive.Org/web/20161022203236/http://8ch.net/pol/res/7933031.html 

https://8ch.net/pol/res/7962287.html 

https://web.archive.Org/web/20161029143658/http://8ch.net/pol/res/7962287.html 

https://8ch.net/pol/res/7946506.html 

https://web.archive.Org/web/20161030073742/http://8ch.net/pol/res/7946506.html 

https://web.archive.Org/web/https://boards.4chan.org/pol/thread/93319969 

https://web.archive.Org/web/20161019170505/http://8ch.net/pol/res/7881571.html 

https://archive.fo/K2oGX 

https://archive.fo/iBS6q 

https://archive.fo/vrl6Q 

https://archive.fo/koTtO 


[hide] 


»fe5c4ffa76090ff71 1 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <bd7dd1 47961 521 9@web.oniichan.onion> 
Date: Sun Nov 20 04:1 3:39 201 6 


MISSING EMAILS WORK IN PROGRESS: 

https://www.reddit.eom/r/DNCleaks/comments/5clikp/work in progress wikileaks the missinglosthidden/ 


[hide] 



»37076ffb32749acb69 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <9b15e1479631348@web.oniichan.onion> 
Date: Sun Nov 20 08:42:28 201 6 


-—BEGIN PGP PUBLIC KEY BLOCK— 

Version: SKS 1.1.5 

Comment: Hostname: pgp.mit.edu 

mQENAjYnbooAAAEIALrEV06TI49DUStofYg/cTnN/XcnGIBrO+lWJldCCI5aYtCu+S9YtrdI 

SBdiEkFM4fKIippivvpgPolSOcDwQH6slQthPAIllWpISE69xf7MvbV0DFf5wAKJxS/9Tiz3 

gynUSpWTE10n0R8zepgkNxhU9J9MVQ/UahwL3BLGxlDJlGfnX9HvnNBRpj4ALcRG+I6CwMcl 

Iq25hOvG+k2dK6002oTrCoYCyC/IzpnUuBQB6nhrls83r3R3Z+eortbMki40WP+X2ydwPKav 

9JiAxV4HEAUjF8pMW2khbJSZKjCPTjDAQNY6hvyDwso5NJGhGxj7aOWjWq0ySCjgAgL4YcEA 

BRG0IkplbGlhbiBBc3NhbmdlIDxwcm9mZkBpcS5vcmc+IDIwNDiJARUCBRA2J26KSCjgAgL4 

YcEBAfLyB/9hxniilfYhIDEW4LK+dr40pJ3chp8eiVd6nxGTD8Vslar7Y99Y3vUKMc65giWN 

xFBEmOEPIslacxch8mK91qjTiIqCSJWDX7us0ZoCzXqqWhvSilUdAa05XnlIreYfids0DISl 

AeWsmxreZrNG2J/ibGdgFcT183pS6EhlBB0gjlBR6vnS3PEokJERplwVYuKTONaCmmneex2B 

YRV0VTuyoBGe9OlAQhreHLaW8X8GyxZ6+WzErqK3meruKT71fDCIULMR4DAYxtZYiwTT65zw 

qQYX3N75WeJgUYhiEXl/JzisripGKzK6jLyVqtzayrxm0QpmTTcjjqzO2wVgMp8tiJwEEAEB 

AAYFAjZGKG4ACgkQolKYYFEYdpG8/wP/UfbmnNKhQJLma7puaLrT6ISjVuhWbSnUOW6PHs63 

fbIim2zNjjOpbIFf8X4a7evVarUhRMO3OtPxmjiUcZ6DBqbQiewHHejc36mWz0HGvJP9h4Re 

x Y AsbpfRbU J iaf61c Sbb JCdliLHxgdrK6 wL VEtJ OIN 9Fpm/rO/h v9 Ah5 O Jg= 

=wKtX 

END PGP PUBLIC KEY BLOCK— 


[hide] 


»eb62b1 00a5bd705b20 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <3bafb1 479631 465@web.oniichan.onion> 
Date: Sun Nov 20 08:44:25 201 6 


C CODE TO READ LOCAL BLOCKCHAIN: 

http:// gateway, glop. me/ipfs/QmRWiFfGzhtxMLdrHXeCAPFvqvrQPRebpEzpNANfhfTMxA/block-reader.c 
/* 

A simple Blockchain .dat file reader. 

Dumps the fields from a local Blockchain file. 

To use: 

gcc block-reader.c -o block-reader 
./block-reader ~/.bitcoin/blocks/b I kXXXXX.dat 

Remove the usleep() calls to make it dump faster, but it's 
not worth it because the program will spit it out way 
too much information. The next version will actually 
do something with the information, but for now this is 
a good starting point. 

*/ 


[hide] 



»3606b9ed9281 e90064 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <b20e61 47963231 1@web.oniichan.onion> 
Date: Sun Nov 20 08:58:31 201 6 


»e5a83dlb5b 

we're going to need those now 


[hide] 


»7babc65affcafe6dda [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <088491 479639435@web.oniichan.onion> 
Date: Sun Nov 20 10:57:15 2016 


»3606b9ed92 
they never listen 


[hide] 


»e796b94e1 058e3d7bb [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <f8a851 479640645@2hu.tld> 
Date: Sun Nov 20 11:1 7:25 201 6 


Download 67508a8a627ed8b97b5d21 f82ae085de1 e3f6575aee6252301 970eb94368959c.pnq Download 1479448424771.gif 
Pilger RT interview CGI? 

https://twitter.eom/Zanting/status/800249726033534976 

Some people are using those two vidoes as proof of concept that CGI is possible 

https://www. youtube. com/watch?v=I314XLZ59iw https ://www. youtube. com/watch? v=ohmaiJT cpNk 

But tbh to me it seems like glitch during video rendering. 


[hide] 


»0c2d82a1 4370b5585a [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <cb51f1479645700@web.oniichan.onion> 
Date: Sun Nov 20 1 2:41 :40 201 6 


»e796b94e!0 

that video is shopped 

confirmed 


[hide] 



»c7e1 71 e8ad51f5235f [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <d6c881479645877@web.oniichan.onion> 
Date: Sun Nov 20 1 2:44:37 201 6 


»e796b94e!0 

/ipfs/QmRxm5fu8gepQF7crYL74CmB93DR2r5ciMoxK7vQqRKGRK 


[hide] 


»1 232c1 1 a3b81 e91 3f4 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <a20c41 479671 638@2hu.tld> 
Date: Sun Nov 20 1 9:53:58 201 6 


Can we please log the current DDoS. What else is down besides reddit? 


[hide] 


»77189f3dea84b24bb7 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <8b01f1479672486@web.oniichan.onion> 
Date: Sun Nov 20 20:08:06 201 6 


reddit is under DDoS? 


[hide] 


»b733dfda0a2defe3ec [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <45b3b1479674352@web.oniichan.onion> 
Date: Sun Nov 20 20:39:12 201 6 


»77189f3dea 

I think it stopped now but yeah, it was earlier today. Probably not related, but they were trying to look at periscopes in front of the 
embassy. 


[hide] 


»597efc4a51 1 08f9777 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <f0a8c1 479675299@web.oniichan.onion> 
Date: Sun Nov 20 20:54:59 201 6 


>they fell for the reddit meme 


[hide] 



»de1 9fc03d499eb70e4 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <5b91d1 479683241 @web.oniichan.onion> 
Date: Sun Nov 20 23:07:21 201 6 


Download salts. png 

OF OB DA 00 FO 35 9A OF wlinsurance-20130815-A.aes256 salt 
Can someone post the other ones? 


[hide] 


»dee896457208ae52fc [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <7729c1479683629@web.oniichan.onion> 
Date: Sun Nov 20 23:1 3:49 201 6 


Download wll.pnq 


[hide] 


»4b0c1 b7223eacc02b8 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <750961 479687354@2hu.tld> 
Date: Mon Nov 21 00:15:54 2016 


Download video. jpg 


[hide] 


»006fc040585363e8e5 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <f366d1 479687528@2hu.tld> 
Date: Mon Nov 21 00:18:48 2016 


»dee8964572 

Remember Litecoin LQ3B36Yv2rBTxdgAdYpU2UcEZsaNwXeATk 


[hide] 


»eacc07714ba4a6e252 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <8a21d1479689726@web.oniichan.onion> 
Date: Mon Nov 21 00:55:26 201 6 



»dee8964572 

>We R 

>Fine 

>8chan 

>Post 

>FAke 

7 


[hide] 


»861 4639221 6458bceb [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <e053f1 4796901 79@web.oniichan.onion> 
Date: Mon Nov 21 01 :02:59 201 6 


The cat with a tie on has to be some kind of code too. 


[hide] 


»5d11da0757232e1b41 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <b629e1479692037@web.oniichan.onion> 
Date: Mon Nov 21 01 :33:57 201 6 


Download penpen.jpg 
»de!9fc03d4 

EVP_BYTESTOKEY CODE: 

>1 cannot understand the flow paths in the OpenSSL code. The whole library is junk. Someone needs to read the code and annotate it 
and tell me which branches it is taking. I am too busy to do this right now. 

Implementations: 

JS: https://github.com/crypto-browserifv/EVP BytesToKey/blob/master/index.is 
JAVA: http://stackoverflow.eom/a/11786924 

Crypto (C++): https://www.cryptopp.com/wiki/OPENSSL EVP BytesToKey 
Python: http://security.stackexchange.eom/a/l 17654 
C#: https://gist.github.com/caspencer/1339719 

Original: https://github.com/openssl/openssl/blob/master/crypto/evp/evp key.c#L74 

>The process by which the password and salt are turned into the key and IV is not documented, but a look at the source code shows 
that it calls the OpenSSL-specific EVP_BytesToKey() function, which uses a custom key derivation function with some repeated 
hashing. This is a non-standard and not-well vetted construct (!) which relies on the MD5 hash function of dubious reputation (!!); that 
function can be changed on the command-line with the undocumented -md flag (!!!); the "iteration count" is set by the enc command 
to 1 and cannot be changed (!!!!). This means that the first 16 bytes of the key will be equal to MD5(passwordllsalt), and that's it. 

>"The first 16 bytes are actually derived using PBKDF1 as defined in PKCS#5 vl.5. The next 16 bytes would be 
MD5(PBKDF1 (PAS SWORD, SALT) II PASSWORD II SALT) and the IV would be MD5(MD5(PBKDF1 (PASSWORD, SALT) II 
PASSWORD II SALT) II PASSWORD II SALT)" 

>openssl enc -aes-256-cbc -pass pass:p@ssword -p -in example_in -out example_out 

salt=649722630B6 1 9D74 

key=F6EEA040C6BDD0EF 1429C4CF4FE09FD3EA 1 C9BDE96B6B4 1 DBFF838E408628BBE 



iv =576F54891CADC222492E038F8ECE557A 

>http://gateway.glop.me/ipfs/QmTm3MJ36RUauRx2AKpgDF6fLWpMwUvdultxf6WaWwRxED/example_in 
>http://gate way. glop. me/ipfs/QmRGV3SqTqAQMdTfMawCfAWuKt3Q7mDtlGG8Bqp7vnUcrg/example_out 


[hide] 


»e9b3e731 1 755599375 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <3fada1479692679@web.oniichan.onion> 
Date: Mon Nov 21 01 :44:39 201 6 


Download evp.cppDownload evp.csDownload evp.isDownload evp.iavaDownload evp.py 
»5dl lda0757 


[hide] 


»cf57aaaa6aedb7bc8f [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <cf1ff1479693400@web.oniichan.onion> 
Date: Mon Nov 21 01 :56:40 201 6 


Download pp.qif 

»5dl lda0757 
»e9b3e731 17 

IMPLEMENTATION BACKUPS: 

Backups 

Implementations: 

JS: https://github.com/crypto-browserifv/EVP BytesToKey/blob/master/index.is 
http://gatewav.glop.me/ipfs/OmarLbzuuH4qUYbiLHru2UvMLpEdznAK5cf4ybo2f79SER/evp.is 

JAVA: http://stackoverflow.eom/a/11786924 

http://gatewav.glop.me/ipfs/QmXdKpPhM3dM5hfBKBPalvn44bW2AaBK3pRN7FW64PFEs5/evp.iava 
Crypto (C++): https://www.cryptopp.com/wiki/OPENSSL EVP BytesToKey 

http://gateway.glop.me/ipfs/OmQCTThDLEb72QZNk4FAW9X5ME4wx4z8Jt4GkboxtEddfh/evp.cpp 
Python: http://security.stackexchange.eom/a/l 17654 

http://gatewav.glop.me/ipfs/QmYRMamhkn6LYvG6mH8qhYVbl8vBxl43WLMQNNzPkeyYu4/evp.pv 
C#: https://gist.github.com/caspencer/1339719 

http://gatewav.glop.me/ipfs/QmRbdPFw6hoNxzenJqiP3tKN75J8Tg2hvi4MVtCiHnUGkQ/evp.cs 

Original: https://github.com/openssl/openssl/blob/master/crypto/evp/evp key.c#L74 
http://gateway.glop.me/ipfs/QmYR4hXHK7uPGd9i YPiXY7jg4gmea2iY3WiY8gr3Lfk2xK/evp.c 


[hide] 



»b3e2f201 5f2230575b [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <88eb91 4796981 68@web.oniichan.onion> 
Date: Mon Nov 21 03:16:08 2016 


Download pp4.gif 
EXTRACTED EVP CODE: 

Download: http://gatewav.glop.me/ipfs/QmZudb4s2nF5JgdeFAlnKzs6MtvaPr58rR4LzddZqYir3s/evp test.pv 
It recreates EVP_BytesToKey completely outside of OpenSSL. 

Example: 

python evp_test.py md5 'p@ssword' '64 97 22 63 OB 61 9D 74' 
salt=649722630B6 1 9D74 

key=F6EEA040C6BDD0EF1429C4CF4FE09FD3EAlC9BDE96B6B41DBFF838E408628BBE 
iv=576F5489 1 CADC222492E038F8ECE557 A 

Which is the same as doing. 

openssl enc -aes-256-cbc -pass pass:p@ssword -p -in example_in -out example_out 
salt=649722630B6 1 9D74 

key=F6EEA040C6BDD0EF1429C4CF4FE09FD3EAlC9BDE96B6B41DBFF838E408628BBE 
iv =576F54891CADC222492E038F8ECE557A 

http:// gateway. glop.me/ipfs/QmT m3MJ36RU auRx2 AKpgDF6fLWpM wUvdu 1 txf6 W aWwRxED/example in 
http://gatewav.glop.me/ipfs/QmRGV3SqTqAQMdTfMawCfAWuKt3Q7mDtlGG8Bqp7vnUcrg/example out 


[hide] 


»86088fd42ffa2a2007 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <2d91 01479701 596@2hu.tld> 
Date: Mon Nov 21 04:1 3:1 6 201 6 


Download Julian Assange- Bitcoin is Much More Than Just a Currency. mp4Download stamps.txt 
Friendly reminder. 

https://www. youtube. com/watch?v=MaB3Zw5 p9c&feature=youtu.be&t=7m06s 
Can someone please run this already. It's really simple but no one has done it. 

http://gatewav.glop.ine/ipfs/OmXOXg4gMknboHDUHctmfQqZYucv2YaVESerRRrisbZVpH/stamps.txt 


[hide] 


»38f1 Odefl 64fb2d3ca [Replvl 
Subject: None 
Name: Anonymous 



MessagelD: <4e2d81479705546@2hu.tld> 
Date: Mon Nov 21 05:19:06 2016 


Download insurance. aes256. 51 20Download wlinsurance-201 3081 5-A.aes256.51 20 

INSURANCE FILE BLOCKS: 

http://gatewav.glop.me/ipfs/QmUUiWflKLshZBQWHDt8vVaabHdMiJA2glmd7YS8qsvMci/insurance.aes256.5120 
http://gatewav.glop.me/ipfs/QmZHmQrNuBLlMJEi3cSn7bYoLShLiqGue5oeqZmcvHtBD6/wlinsurance-20130815-A.aes256.5120 
Post more if you can make them. 

Simply do head -c [number of bytes] [file] > [newfile] 


[hide] 


»6e8a7df3915dae83e3 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <74dd1 1479707830@2hu.tld> 
Date: Mon Nov 21 05:57:1 0 201 6 


Download enc.cDownload pp3.gif 
https://github.eom/openssl/openssl/blob/master/apps/enc.c 

> /* 

> * Note that str is NULL if a key was passed on the command line, so 

> * we get no salt in that case. Is this a bug? 

> */ 


[hide] 


»db6ae9ff1 1 592f521 b [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <a67981479769350@web.oniichan.onion> 
Date: Mon Nov 21 23:02:30 201 6 


Download snow. png 

»9e2581f80d 
NORMIE DUMP: 

Tutorial (getting cablegate.zip and other files): 

https://www.reddit.eom/r/WhereIsAssange/comments/5e55p3/a simple blockchain decoding tutorial/ 

Code: 

http://gateway.glop.me/ipfs/QmSU67Ei3TerNe32CcZTgd48iKqsVvBTgeralqBWFiKK9V/iean.py 

http://gateway.glop.me/ipfs/QmburFHeUtM3wdrEi3rmUuBkx6iDmYpreyGCvHiigJhZnh/iean b.py 

http://gateway.glop.me/ipfs/QmafUK8hYKztKD3hNNzF4EsW3N5nUcNvHZ4auEidiLkqJd/iean2.py 

http://gatewav.glop.me/ipfs/QmaVdcqSowfbr58295ipeZxUU97FmqLXBadBgicXwuqXa9/block-opreturn-finder.py 

http:// gateway, glop. me/ipfs/QmRWiFfGzhtxMLdrHXeCAPFvqvrQPRebpEzpNANfhfTMxA/block-reader.c 

https://codepaste.net/gh3mui 

https://codepaste.net/flca5s 

https://codepaste.net/2kk75e 

https://codepaste.net/4ynlvy 



Leads: 

Blocks 434304-435711, 383000-383100 

https://s6424n4x4bsmqs27. onion. to/.media/t 8bb6afe8feb8a9836a9b23a505c 14809 -imagepng 

691dd277dc0e90a462a3d652all71686de49cfl9067cd33c7df0392833fb986a 

7379ab5047bl43c0b6cfe5d8d79ad240b4b4f8cced55aa26f86dld3d370c0d4c 

d3c 1 cb2cdbf07c25e3c5f5 1 3de5ee3608 1 a7c590e62 1 f 1 f 1 eab62e8d4b50b635 

Cce82f3bde0537f82a55f3b8458cb50d632977f85c81dad3el983a3348638f5c 

2a 1 4783f74796ace53e0a6859a70 1 2723d3d6cd9dacf72d4e90a3394484093df 

657aecafe66d729d2e2f6f325fcc4acb8501d8f02512dlf5042a36ddlbbd21dl 

05e6c80d9d6469e7dl328e89b9d971bl9972594701586bbcbd70070f2be799db 

623463a2a8a949e0590ffe6b2fd3e4el028b2b99c747e82e899da4485eb0b6be 

5143cf232576ae53e8991ca389334563fl4ea7a7c507a3e081fbef2538c84f6e 

https://blockchain.info/tx/6ad9a4728d3a06dc6452324f67cf5dea9a8bc5b286089e6a04b884135b9dafe0 
https://bitcointalk.org/index. php?topic=260881 

'"Important"' dates: 

>18 October: large number of Wikileaks bitcoin transactions 
https://blockchain.info/address/lHB5XMLmzFVi8ALi6mfBsbifRoD4miY36v 

>26 October (01:21:35): Endchan post on how to use bitcoin data to produce cables. 
https ://endchan. xyz/pol/res/20366 . html#20607 

>26 October (02:00:00) Bitcoing transaction fees increase dramatically, occurs 39 minutes after the above post. 
https://imgur.eom/a/steMy 

>26 Oct: The blockchain is blocked with $10 fees, 43000 unconfirmed transactions appear in the mempool, Bitcoin 0.13.1 is released 

and a 'soft fork' begins: 

https://bitcoin.org/en/release/vO. 13. 1 

https ://endchan. xyz/pol/res/20366 . html#q20647 

>7 Nov: Absurdly high transaction fees. 

https://www.reddit.eom/r/Bitcoin/comments/5bizrb/lblock confirmation fee estimates are absurdly/ 

>Misc attacks: 

https://np.reddit.eom/r/WhereIsAssange/comments/5dtsnc/blockchaininfo most widely used site to check/ 
https://np.reddit.eom/r/Bitcoin/comments/5731is/it looks like blockchaininfo has been dns hijacked/ 


[hide] 


»db0dab7b4ae7420326 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <4bc001479776532@web.oniichan.onion> 
Date: Tue Nov 22 01 :02:1 2 201 6 


Download rms.jpq 

[[[ To any NSA and FBI agents reading my message: please consider ]]] 

[[[ whether defending the US Constitution against all enemies, ]]] 

[[[ foreign or domestic, requires you to follow Snowden's example. ]]] 

>Canary not updated for a week: 

>https://riseup.net/pl/about-us/canary 
>Fingerprints no longer appear: 

>https://riseup.net/pl/security /network-security /certificates 
>Fingerprints deleted: 

>https://github.com/riseupnet/riseup_help/commit/8a8c98e0aaa635130a899cl980569f34633dl59d 
>https://twitter.com/riseupnet/status/797 142735283257345 



[hide] 


»5fb9c40c1dd8c58a9d [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <a837f1479779244@web.oniichan.onion> 
Date: Tue Nov 22 01 :47:24 201 6 


>trusting literal communists 

you got what was advertised so I don't get what you're whining about. 


[hide] 


»97460203af4e18eab9 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <f63d81 479836633@2hu.tld> 
Date: Tue Nov 22 1 7:43:53 201 6 


»e5a83dlb5b 

Please post this as soon as you can. 


[hide] 


»75d8c1 1 c3fd22a86f4 [Reply] 

Subject: nice bait 
Name: baited faggot 
MessagelD: <4a2c1 1479846426@chan> 
Date: Tue Nov 22 20:27:06 201 6 


Download disbait.pnq 

»97460203af4e 1 8eab9 
Meet 

»7babc65affcafe6dda 

>2hu.tld 

>clearnet 

>asking for tor only chan 
>nice bait 

If you are being real here then go to #wikileaks on i2p’s ire I can give you about two that are still running but if you don’t hurry my 
internet will cut again : A ) (because it's shit and I need a new one) 


[hide] 


»c78f76928ac30f5d20 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <7a0021 479851 363@web.oniichan.onion> 
Date: Tue Nov 22 21 :49:23 201 6 



Download 


end .png 

HOW TO GET THE KEYS (AND MORE) FROM THE BLOCKCHAIN: 

The goal is to make very simple code that is easy to use and understand so that everyone can do this. This is a rough explanation of 
how it works. 

There are two main approaches users are taking to decode messages in the blockchain. Scanning transactions, let's call this 'tx 
scanning', and scanning blocks, let's call this 'block scanning'. The main reason users are not yet able to see meaningful content is 
because both approaches have to be combined. 

TX SCANNING: 

When you scan by transactions, you look for a transaction number (tx id), and decode its contents. When you know the tx id, you can 
easily see which wallets were involved. Some messages require you to combine the decoded data from multiple tx ids. You can 
identify which tx ids are relevant by looking at transaction histories of the wallets involved. This strategy is used for the 'Cablegate 
Backup’. In that case, the list of tx ids is directly told to the readers in the first message. However, you can compile this list on your 
own by 'tx crawling’. To do this, follow these steps: 

. For each tx, look at the wallets that received money and find those that spend it (in this case it is only one per tx). 

. For that wallet, look at its transaction history and find a transaction that follows a similar pattern, i.e., it involves multiple wallets and 
only one spends the funds. 

. Continue doing this until you are not able to see the pattern repeat itself. 

BLOCK SCANNING: 

When you scan by block, you will be able to find encoded data more easily but it is harder to extract the tx id and wallets. One benefit 
of block scanning is that you can explicitly search for file headers and important strings. For example you can directly search for the 
magic numbers in GPG files. When you find one of these, you can then tx crawl from that starting point in order to get all pieces of 
the file. More concretely, if you want to find the Cablegate Backup with a block scanner, you could search for the magic number of 
Zip files. Then, when one is found, you can find the tx id that contains it, and finally tx crawl to get all the pieces. Yet, file headers are 
just one of the many other patterns that can be used to find important transactions. Examples of others are: 

. Magic numbers: Look for the first bytes in different types of file, ’file’ can be used in UNIX. 

. Ability to compress: Compress the decoded output. If the size is reduced, the output is possibly a message or part of a file. 

. Text: If the decoded output has text, it might have information. 

. Keywords (Very important): Search for relevant keywords, e.g., checksums for files in Wikileaks.org, checksums for the insurance 
files, hashes, dates, names, time stamps, etc. 

. Reversibility: Some messages are in reverse and need to be flipped. This should be tried both before and after decoding. 

Both scanners have to be used. The starting points for the searches should be Wikileak's wallet, important dates (for example, during 
the DDoS attacks), previous messages and checksum hashes. The Cablegate Backup was a bit simpler than the more recent messages. 
In that case, only one wallet spent the funds in each transaction, and simply looking at wallet's next transaction was enough to find all 
the pieces. Newer messages are bit more complicated. Some of the wallets that receive money make multiple transactions with no 
encoded data before proceeding with the 'real' transaction. Moreover, in a lot of cases, all wallets involved spend the funds (not just 
one). Therefore, the crawler has to keep track of all wallets that receive funds, and all future transactions of that wallet while using 
techniques (like those above) to detect encoded data. A transaction tree should be kept and the pieces of each files should be combined 
in multiple orderings. 

If you implement the process described above you will find all the keys, other backups and other files that are not released. One way 
to test your code is to search for checksum hashes for files that have already been published at a specific date. There are multiple 
messages in the blockchain that include file hashes and dates. 

I recommend you use a local copy of the blockchain and carry out the search on a computer that has no internet access. Work in 
groups and share the process. Remember to look at other cryptocurrencies as well and to encode your findings into the blockchain 
yourself. 

Good luck! 


[hide] 


»d4501 e846bea64066f [Reply] 
Subject: None 
Name: otherFag 



MessagelD: <5b4d01479857181@web.oniichan.onion> 
Date: Tue Nov 22 23:26:21 201 6 


Download 7379ab5047b1 43c0b6cfe5d8d79ad240b4b4f8cced55aa26f86d 1 d3d370c0d4c 

OK so walked away for a few weeks b/c was tracking down something else. But that something else I think is only gonna work out if 
this WL nut gets cracked. 

So I ran the python3 version of the jean script on the first suspect TX 
7379ab5047bl43c0b6cfe5d8d79ad240b4b4f8cced55aa26f86dld3d370c0d4c 

I get txt 

>file attached 


[hide] 


»a0237b7c1 9329b2d83 [Repivl 
Subject: None 
Name: Anonymous 

MessagelD: <9b8541 479861 066@web.oniichan.onion> 
Date: Wed Nov 23 00:31 :06 201 6 


Download 7379ab5047b1 43c0b6cfe5d8d79ad240b4b4f8cced55aa26f86d 1 d3d370c0d4c 
»d4501e846b 

This is what you should be getting. 

Do a diff and compare it to yours. 


[hide] 


»00e48a2707370ba7d8 [Reolvl 
Subject: None 
Name: Anonymous 

MessagelD: <a796d1 47986221 8@web.oniichan.onion> 
Date: Wed Nov 23 00:50:1 8 201 6 


»a0237b7c!9 
yeah not even close... 

I'll dive in deeper tomorrow and see why it is so different. The cablegate TX worked fine though 


[hide] 


»5f3fec1 744adea6d66 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <430b61 47986531 9@web.oniichan.onion> 
Date: Wed Nov 23 01 :41 :59 201 6 


https://github.com/maximilliangeorge/wikileaks-block-collector 


[hide] 



»ec1 61 0659a081 d8c09 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <de9ba1479875096@chan> 
Date: Wed Nov 23 04:24:56 201 6 


»db0dab7b4a 

What if: the USA means nothing, since your technology and society has been already sold to international banks. 

Here's the shit, if you idiots haven't gotten it: "USA" doesn't exist. It's no longer a nation. The "Constitution" means nothing. Why 
follow a "martyr" that desires a country that no longer exists. 

»5fb9c40cld 
This pretty much. 


[hide] 


»0b65397c833f382b72 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <a55c81479882378@web.oniichan.onion> 
Date: Wed Nov 23 06:26:1 8 201 6 


Mirroring an interesting post from htt p:https://s6424n4x4bsmqs27. onion, to/pol/res/20366. html#22993 before it gets modded. 

You can archive this to if you are fast... 

Leaving the data time along with the post number in for you to check. 

Anonymous 11/23/2016 (Wed) 06:10:36 [Preview] No. 22993 del 

I might be compromised. So, before I get silenced. I'd like to present some tips for those investigating the blockchain angle (in the case 
that I am unable to continue my work): 

1. Sort transactions based on TX Fees. The DMS TX(s) will probably have a high fee associated with it to a) ensure its inclusion in the 
block (against the spamming attacks we're seeing) and b) draw attention to it. If a transaction contains an OP_RETURN and has an 
unusually high fee, IT IS WORTH INVESTIGATING. 

2. Look for duplicate OP_RETURN data. Provided there wasn't a lone machine setup to post the DMS, it would likely be posted twice 
or more. Create a script to store transactions in a database. Store block number, date, op_return, fee and amount (if any of the outputs 
contain "911", also pay attention.) 

3. The DMS will likely NOT come from the Wikileaks address (but might go to it). In the event that the server(s) hosting the DMS got 
compromised, the attacker would have access to that address' private key (and thus all of WikiLeaks' funds). 

4. This address might be worth investigating: htt 

ps://blockchain.info/address/lNquFlc4AuKx9YJtP9SsiGqhazfa72vPBM?offset=100&filter=0 

Many OP_RETURNs and all on the 10/16/2016 within a period of a few hours. I have not had the chance to investigate further. 

Some side notes: 

Bootstrap8080.bitmessage.org and Bootstrap8444.bitmessage.org were down last night around 3AM (USA time). Worth checking 
DNS history on these to ensure they weren't compromised. 

My computer is sending ICMP packets routinely to addresses in San Francisco and UK. This is one of my reasons to suspect 
compromise (could these be packing non-erronous data?). 

If you don't hear from me within a week, consider me silenced. Solution to hash below will be posted as Proof of Identity at a later 
date. 

a52a2c343c800197eeb29766147f26e50aac8dfd2b621eblf8085dc2126d7bd0 


[hide] 



»878dc43eb9ddb0defd [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <7a951 1479898251 @web.oniichan.onion> 
Date: Wed Nov 23 1 0:50:51 201 6 


»0b65397c83 

>My computer is sending ICMP packets routinely to addresses in San Francisco and UK. This is one of my reasons to suspect 
compromise (could these be packing non-erronous data?). 

>Solution to hash below will be posted as Proof of Identity at a later date. 

>a52a2c343c800 1 97eeb29766147f26e50aac8dfd2b62 1 eb 1 f8085dc2 1 26d7bd0 

baaaaaaaaaaaaaaaaaaaad opsec 

baaaaaaaaaaaaaaaaaaaaaaaaaad 

dunno whether to reply or just laugh. 


[hide] 


»d1 bf72c6e4b6aa5eb9 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <fa4e91 47991 4754@web.oniichan.onion> 
Date: Wed Nov 23 1 5:25:54 201 6 


»a0237b7c!9 

Ok so not sure what changed from when I ran it yesterday, but my output file on 

7379ab5047bl43c0b6cfe5d8d79ad240b4b4f8cced55aa26f86dld3d370c0d4c seems to match (just by my eye) the one you uploaded. 
But when I run diff it still says it's different (assume b/c of filename?) and when I run file on it I get DOS executable instead of GPG 
symmetrically encrypted data (CAST5 cipher) which seems to be what it's suppose to output. 

I also ran d3clcb2cdbf07c25e3c5f513de5ee36081a7c590e621flfleab62e8d4b50b635 and it file also reports DOS exe on that one as 
well. 

I am going to start tracing TX now to see if I can get the 130 TX that was used as the example for the cablegate zip. Just trying to do 
due diligence on recreating the steps before jumping into tracing the TX on/around OCT 16 like I was originally doing a few weeks 
back. 


[hide] 


»92ff52d6ee7146d8b2 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <ba48f1 47991 5444@web.oniichan.onion> 
Date: Wed Nov 23 1 5:37:24 201 6 


»878dc43eb9ddb0defd 

Just laugh, he doesn't know what a firewall is or text modification along with anyone could solve the hash and post the solution. 


[hide] 


»e58f8a07fd61 OaddOO [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <eac1 51479918554@web.oniichan.onion> 



Date: Wed Nov 23 16:29:14 2016 


how are these TX: 

7379ab5047bl43c0b6cfe5d8d79ad240b4b4f8cced55aa26f86dld3d370c0d4c 
d3c 1 cb2cdbf07c25e3c5f5 1 3de5ee3608 1 a7c590e62 1 f 1 f 1 eab62e8d4b50b635 
Cce82f3bde0537f82a55f3b8458cb50d632977f85c81dad3el983a3348638f5c 
2al4783f74796ace53e0a6859a7012723d3d6cd9dacf72d4e90a3394484093df 
657aecafe66d729d2e2f6f325fcc4acb850 1 d8f025 12d 1 f5042a36dd lbbd2 Id 1 
05e6c80d9d6469e7dl328e89b9d971bl9972594701586bbcbd70070f2be799db 
623463a2a8a949e0590ffe6b2fd3e4el028b2b99c747e82e899da4485eb0b6be 
5143cf232576ae53e8991ca389334563fl4ea7a7c507a3e081fbef2538c84f6e 

tied to WL? Other than the amount and escrow I can't find how they are connected to WL. I traced the wallets that the BC came from 
and where the change went (several accounts deep) and can not find how these TX originated/end up with WL. 


[hide] 


»e75b436d6996d45f3a [Repivl 
Subject: None 
Name: shasta 

MessagelD: <287531479921 229@web.oniichan.onion> 
Date: Wed Nov 23 1 7:1 3:49 201 6 


Download 1 NquFI c4AuKx9YJtP9SsiGqhazfa72yPBM wallet. png 

»92ff52d6ee 
repost from end- 

FWIW - 1 pulled the TX for that suspect wallet (lNquFlc4AuKx9YJtP9SsjGqhazfa72yPBM) and it has 535 TX broken up into a few 
different timestamps all on OCT 16. 

4-0.00157125 @ 18:55 
43 - 0.0001293 @ 19:46 
226 - 0.0001293 @ 19:52 
260 - 0.0001293 @ 20:41 
1 -0.0001543 @ 21:18 <— lastTX 

also - the output address for all the TX are not able to be decoded (strange!) 

>pic related 

I have them all in a csv if someone wants to try and run it through the py script for multiple TX. I can't get that script to work for me. 


[hide] 


»a6e7de8e1eaff977f8 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <b28cf1479923786@web.oniichan.onion> 
Date: Wed Nov 23 1 7:56:26 201 6 


Download dl f776ac2ec96c29ca0b050e0808ed1 68954860a0f6ab3f7c0be5593583c2084-201 61 016-1 946 
»e75b436d69 

>43 - 0.0001293 @ 19:46 

each of those strings is 40 bytes x 43 = 1720 bytes/1.72 Kb 

I only went through the first 3 each 40 bytes = 180 bytes but put together in one string = 208 bytes. Weird, maybe... probably not 
thinking through it correctly right now. But the first string of this set of 43 is attached 



[hide] 


»77a171dc8b87ebbd30 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <40bb21479925370@web.oniichan.onion> 
Date: Wed Nov 23 1 8:22:50 201 6 


»75d8cl lc3f 

>i2p's ire I can give you about two 

Please let me know when you are able to do this. 

»e75b436d69 

Can you upload the csv here? 


»e58f8a07fd 


[hide] 


»6ad2894ab0274c9acb [Replvl 
Subject: None 
Name: shasta 

MessagelD: <bcb591479926502@web.oniichan.onion> 
Date: Wed Nov 23 1 8:41 :42 201 6 


Download 2016-06-03 insurance. aes256. 51 20Download wlinsurance-201 3081 5-A.aes256.51 20Download 

wlinsurance-20130815-C.aes256.5120Download insurance. aes256. 51 20Download wlinsurance-201 3081 5-B.aes256.51 20 

file snippets 


[hide] 


» 1 f27cd89c1 1 45ccd3f [Replvl 
Subject: None 
Name: shasta 

MessagelD: <0a9701479926634@web.oniichan.onion> 
Date: Wed Nov 23 1 8:43:54 201 6 


Download history-1 6-1 0-201 6-1 6-1 0-201 6.csv 

»77al71dc8b 

csv of that wallet on Oct 16 


[hide] 


»953db33e1 b070b57df [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <c2e921479930078@web.oniichan.onion> 
Date: Wed Nov 23 1 9:41 :1 8 201 6 



»0b65397c83 

>fees 

There were some recent spikes in fees on Oct 27, Nov 7, and yesterday (Nov 22). This is easy to verify and there are several links to 
sources in this thread. It could be a coincidence, but these increases have taken place when users have found new information and 
attempted to encode it in the BTC blockchain. This can be verified by looking at the dates of certain posts in this thread. Large fees 
and a flooded mempol prevent us from encoding messages for others to recreate what was done here. However, there are other 
cryptocurrencies. I recommend pushing to BTC, Litecoin, and another cryptocurrency that starts with the letter 'M'. 

>Look for duplicate OP_RETURN data 
This is very important. 

>if any of the outputs contain "911", also pay attention. 

Some suspect that these transactions are made by BTC bot/scammers. I’ll post some of that information for completeness. I don’t 
recommend anyone follow this lead directly as the steps posted above are sufficient for users to find all of the messages. Kelly 
Kolisnik tweeted lBpjNVeYm6kiER2m7N6FXy3zNZbqEkplTm on Nov 21st. That wallet is involved in a 91 1 transaction which can 
be seen here: https://blockchain.info/tx/dfd7522529bd9af9556d68af2214a068f6de66b5ell488e84deede26c817bde6 Taking 
Snowden's tweeted hash and turning it into a BTC wallet results in lEnDZkT8Thep9sfbAy5gwg23EHhZw7tYwg. If you look at that 
wallet, you will see several transactions with 911. https://blockchain.info/address/lEnDZkT8Thep9sfbAy5gwg23EHhZw7tYwg Note 
the dates and compare them to the date of the tweet 

>ICMP packets 

It’s good to have firewalls and to use something like Wireshark to track what’s going on. However, I strongly recommend you do all 
your blockchain work in a computer that’s not connected to the internet. When you find something and want to communicate your 
findings to others, use redundancy. My advice is to post the information on a darknet site, clearnet site, regular site, BM, and in person 
to someone in your group. In that order. If you are able to encode messages into the blockchain, that should be the first thing that is 
done. If you find something sensitive in the blockchain, do not send others any information about what is it, or where it was found. 
Instead, send them an actual piece of the blockchain that contains it first, and then explain. 


[hide] 


»4e5688bfff7670b41 b [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <18b4d1479930866@web.oniichan.onion> 
Date: Wed Nov 23 1 9:54:26 201 6 


»6ad2894ab0 

SALTS: 

insurance. aes256 DE 18 IB 73 EF F3 5E 39 DA 
wlinsurance-20 1308 1 5- A. aes256 OF OB DA 00 FO 35 9A OF C8 
wlinsurance-20 1308 1 5-B .aes256 AB C2 04 75 6B AB 85 BE 30 
wlinsurance-20 1308 1 5-C. aes256 73 6B 46 4C 2F 84 9A C2 A4 

INSURANCE SNIPPETS: 

http://gateway.glop.me/ipfs/QmUUiWfl KLshZBQWHDt8yVaabHdMiJA2glmd7YS8qsvMci/insurance.aes256.5120 

http://gateway.glop.me/ipfs/QmZHmOrNuBLlMJEi3cSn7bYoLShLiqGue5oeqZmcvHtBD6/wlinsurance-20130815-A.aes256.512Q 

http://gatewav.glop.me/ipfs/QmRRAnoHgZGqMrJodHA3Ni6GeQ5i4ylAHUbG8MgVXWshMH/wlinsurance-20130815- 

B. aes256.5120 

http:// gateway. glop.me/ipfs/QmPCPmG wyCghyMrVENUB 1 AEbzkZ9dULE9rB Jc VMqc5RG 1 M/ wlinsurance-20 130815- 

C. aes256.5120 

http://gatewav.glop.me/ipfs/OmNdwpvqWXkYsxPnioL8rSZZpVDRDNu3YYvddsQ7dLdrEC/2016-06-Q3 insurance. aes256. 5 120 


[hide] 


»36a331 99089091 71 d3 [Replvl 


Subject: None 
Name: shasta 

MessagelD: <267b81479931925@web.oniichan.onion> 
Date: Wed Nov 23 20:1 2:05 201 6 


Download 2016-11-07 WL-lnsurance EC.aes256.5120Download wikileaks-insurance-201 20222. tar. bz2.aes. 51 20Download 

2016-11-07 WL-lnsurance UK.aes256.5120Download 2016-11-07 WL-lnsurance US.aes256.5120 
remainder insurance snippets 


[hide] 


»505a696a3c4f0b8031 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <42921 1479932504@web.oniichan.onion> 
Date: Wed Nov 23 20:21 :44 201 6 


»cf7ef0caf8 

http://8ch.net/pol/res/8319373.html 


[hide] 


»5257babec83166d3cd [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <9cfdd1 479939429@web.oniichan.onion> 
Date: Wed Nov 23 22:1 7:09 201 6 


»77al71dc8b87ebbd30 

Alright my time is in UTC so 1 1/24/2016 01:00:00 

If you can't make it then just ask anonlobo for the sites, I should of left him a message to send them to you. 


[hide] 


»83d81059da9a636225 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <6200b1479939947@web.oniichan.onion> 
Date: Wed Nov 23 22:25:47 201 6 


»4e5688bfff 

»36a3319908 

INSURANCE SNIPPETS: 

http://gatewav.glop.me/ipfs/OmUUiWflKLshZBQWHDt8vVaabHdMiJA2glmd7YS8qsvMci/insurance.aes256.512Q 

http://gateway.glop.me/ipfs/QmZHmOrNuBLlMJEi3cSn7bYoLShLiqGue5oeqZmcvHtBD6/wlinsurance-20130815-A.aes256.5120 

http://gatewav.glop.me/ipfs/OmRRAnoHgZGqMrJodHA3Ni6Ge05i4vlAHUbG8MgVXWshMH/wlinsurance-20130815- 

B. aes256.5120 

http:// gateway. glop.me/ipfs/QmPCPmGw yCghyMrVENUB 1 AEbzkZ9dULE9rB Jc VMqc5RG 1 M/wlinsurance-20 130815- 

C. aes256.5120 

http://gatewav.glop.me/ipfs/OmNdwpvqWXkYsxPnioL8rSZZpVDRDNu3YYvddsQ7dLdrEC/2016-06-03 insurance. aes256.5 120 
http://gatewav.glop.me/ipfs/OmcDMXxr99Fi583oZKYqFzg8TwomugeV49oFkMrtGHEJ6Z/2016-ll-Q7 WL- 
lnsurance EC.aes256.5120 



http:// gateway. glop.me/ipfs/QmP AoxkRc JERJEyj 3uXsnKwe8 1 9 WkqnX2Gp 1 V gpoaxLtys/20 16-11 -07 WL- 
Insurance UK.aes256.5 1 20 

http:// gateway. glop.me/ipfs/QmaYUUco 1 V tV urovbrtboMvu6kvFp9pdz6CEA97ftxoi y5/20 16-11 -07 WL-Insurance U S . aes256.5 1 20 


[hide] 


»904c98a1 84e6db0b1 9 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <aeb851 479941 708@web.oniichan.onion> 
Date: Wed Nov 23 22:55:08 2016 


Download bitcoin-insertion-tool.pyDownload send-op-retum.py 
CODE (ENCODING): 

http://gatewav.glop.me/ipfs/OmXV7haSznR3LOtrVEeirSQueVbZlu5s6ASGHCfWVnNvbD/bitcoin-insertion-tool.py 

http://gatewav.glop.me/ipfs/Qmdd3u4FdrMwM5z4MfgCAwnDkXTb6taUXdlFAlDrimrvhh/send-op-return.py 

https://21.co/learn/embedding-data-blockchain-op-return/#creating-and-sending-the-transaction 


[hide] 


»f023e1 32dadc82db42 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <526ec1479944895@web.oniichan.onion> 
Date: Wed Nov 23 23:48:1 5 201 6 


DISINFO: 

TuringThe2nd @TuringThe2nd Nov 5 
It is near. 

8 1 Ib7e49274a0 1 9cf2402eb9ebd7ffcdc6d02 1 c25 1 c85fb62 1 8e2828935eff35 
@wikileaks 

0 replies 11 retweets 17 likes 
TuringThe2nd @TuringThe2nd Oct 18 

Time is running out. 40a861f05c8a98cc88594781d81bf233flfal If56f340135e30c41d78808273f 
0 replies 15 retweets 16 likes 
TuringThe2nd @TuringThe2nd Oct 17 

@wikileaks You will need this a bit later. #WikiLeaks 8089b0f7040ab3225dff8313fdb366decdc58dcdc409bc91f825e79bf756b4fd 


[hide] 


»1 071 a7d26944d289b8 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <5dd081 479946661 @web.oniichan.onion> 
Date: Thu Nov 24 00:1 7:41 201 6 


RIP Wikileaks 
2006 - 2016 




[hide] 


»01 dfc2a8ea81 fdf2ff [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <a1a3d1479949978@web.oniichan.onion> 
Date: Thu Nov 24 01 :1 2:58 201 6 


tx dc88c8a9fe6cd63dl2da51e2306682b8e3159750823cb2f748e03f9e928d96d5 


[hide] 


»45d6ccd831 ef582c59 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <3073c1479973692@web.oniichan.onion> 
Date: Thu Nov 24 07:48:1 2 201 6 


Download trid linux.zipDownload get files in wallet.pyDownload tridupdate.zipDownload get wallet txs.ov 
While we wait to get a proper database... here's a script that will give you a transaction list for each BTC address (it just scrapes 
blockchain.info): 

http://gatewav.glop.me/ipfs/OmS6cQ14HgdfR8H2RLStTsYP8oikoMrwYQDLf243rtuoJ8/get wallet txs.py 
https://codepaste.net/rzo26r 

Example: 

python get_wallet_txs.py UVQwlsiukrxGFTZykXFDtcf6SExJVuTVE 
Will save the list to UVQwlsiukrxGFTZykXFDtcf6SExJVuTVE_tx_list.txt 

And here's a script to find transactions with encoded files. Scans all transactions made by a wallet. Prints tx id and file type. Saves 
decoded data and a list of tx ids. 

https://codepaste.net/dmlhyo 

http://gatewav.glop.me/ipfs/QmPidNDyo9Zn89BeGsFMErhiQ9zcurkVYCveJC6pC9fKHo/get files in wallet.py 
Setup: 

Download TrID http://markO.net/soft-trid-e.html 
Do 'chmod +x trid' 

Download tridupdate.py http://markO.net/download/tridupdate.zip 
Do 'python tridupdate.py' 

TrID and get_files_in_wallet.py should be in the same directory. 

Example: 

python get_files_in_wallet.py 1 C3 W StWpfCmsoG5 WmDeaYS wAeEY 1 nc W Qoh 



It should find a PDF. It will save all decoded data from transactions, a list of tx ids and a list of tx ids that include file headers. 


[hide] 


»34b2b57728bf084998 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <8c75a1479974886@web.oniichan.onion> 
Date: Thu Nov 24 08:08:06 201 6 


Download cce82f3bde0537f82a55f3b8458cb50d632977f85c81dad3e1983a3348638f5cDownload 
d3c1 Cb2cdbf07c25e3c5f51 3de5ee36081 a7c590e621 f 1 fl eab62e8d4b50b635 

»45d6ccd831 

python get_files_in_wallet.py 16jv3REqedeiTK8dzygyirNLWiP5gAc2KX 

Collecting data from file: Cce82f3bde0537f82a55f3b8458cb50d632977f85c81dad3el983a3348638f5c 
100.0% (.PGP/GPG) PGP symmetric key encrypted message (salted+iterated) (3001/2) 
d3c 1 cb2cdbf07c25e3c5f5 1 3de5ee3608 1 a7c590e62 1 f 1 f 1 eab62e8d4b50b635 

Collecting data from file: d3clcb2cdbf07c25e3c5f513de5ee36081a7c590e621flfleab62e8d4b50b635 
100.0% (.PGP/GPG) PGP symmetric key encrypted message (salted+iterated) (3001/2) 

2 transactions found 
2 file headers found 


[hide] 


»89004de07d4fb1 bl 0a [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <276b71480022826@web.oniichan.onion> 
Date: Thu Nov 24 21 :27:06 201 6 


Download get files in wallet. ov 

Bug fix: http://gateway.glop.me/ipfs/OmZNLgLEtiveJiVGrfqowSuoZuETL54LYGPeQiLAkegevY/get files in wallet.py 

python get_files_in_wallet.py 3CaaFJF39T9TWiNtCKTnU79A3NvGeWKdqL 

Ieef3c9474a065b38cfb8blcac0ce6efl5517381 Ie0fdfb04a54df2a0ef74b40 
100.0% (.FLC) FLIC FLC video (1/1) 

52968900d9963e854a84a6dbda0a87dl511e65cel0d4ccf2a46b72f52509d2eb 
100.0% (.FLC) FLIC FLC video (1/1) 

533bd9226bbe9ef9d7625910da39db27ea0b780d36bc8dl3fac4c879aa56fcfe 
c 1 39c0b63 1 d969dd98ed 14fd0aa 1 1 29957b62689a9 1 98656dl 57963e54fb04ee 
100.0% (.FLC) FLIC FLC video (1/1) 

Ifbcff35263al7061f58d9b41900cc9ac44f879d534729582f666dc289b48794 
100.0% (.FLC) FLIC FLC video (1/1) 

4c729d0c64a40e4ebl624e8f3a499354a30508b643248b9a9531af716c4a5a90 
100.0% (.FLC) FLIC FLC video (1/1) 

7d43580841bc8b8baaa3097fllc83fea454a56535a34a49350bl2a9cfdabb7ac 
100.0% (.FLC) FLIC FLC video (1/1) 



[hide] 


»a3540f5558fc690a25 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <cdc3f1 48002441 6@web.oniichan.onion> 
Date: Thu Nov 24 21 :53:36 201 6 


Download 4bb09877350505dd2070f4391 acd6251 e8c5b4e89da4855de1 c964fe99ef81 9d 
python get_files_in_wallet.py lKEyVEndor3p6c3NL2UiVhscXPZKb3DfYl 

d68a906b0608e8feb6402830b0f2961b296dl 18cb6c825ace4ebd48db05f3fl7 
100.0% (.MP3) MP3 audio (1000/1) 

c0e9 1 8dd lb 1 97f04fd 15a569fdc377bd9e0a7987b969d 1 4dc295cddba5c60dc 1 
100.0% (.DMG) Disk Image (Macintosh) (1000/1) 

8003eef72e31269c0668358189ec9dc6bfc259df86d3e49c7b77ae0e247fc489 
100.0% (.BS/BIN) PrintFox (C64) bitmap (1000/1) 

dcd2d0ca8a4a20ecd4382el0bl0058e706f2dl 154a9332ea99c7be52aabe4f0e 
100.0% (.) QuickBasic BSAVE binary data (1000/1) 

8143f7dfbb9e8e2311a41014358adf057312063786a9280f0193e00e481cf25e 
100.0% (.FLI) FLIC FLI video (1/1) 

C98al4c83d2ca53e54e97db8360f2efb0bfel05d63d81 1274212ee28b5cbf465 
100.0% (.FLI) FLIC FLI video (1/1) 

8c79839b7d7088efbf56945c08a6cce4db4ac625c527fl70143e0854011a0625 
100.0% (.DMG) Disk Image (Macintosh) (1000/1) 

b043983e0556c73a5f48bc680a70a5f842241eb7cc4c5889a71575633ac0d221 
100.0% (.DMG) Disk Image (Macintosh) (1000/1) 

09a86aa780980cd5f66f966c8bf3009dlc028d5caa6a3e373f70e6986ca60144 
100.0% (.INI) Generic INI configuration (1000/1) 

4bb09877350505dd2070f4391acd6251e8c5b4e89da4855delc964fe99ef819d 
"T00.0% (.GPG) GNU Privacy Guard public keyring (1000/1)'" 

bcea9f0a0306ef209 19251 a002ce3 1 294e82dfa7 1 7f30b3a5c555e 1 2095e83c 1 
100.0% (.INI) Generic INI configuration (1000/1) 

9df5abc2ce02d9471deba79b067fd3ca0ffa227f0efaccdf616al45371c68a35 
100.0% (.FLI) FLIC FLI video (1/1) 

C2ce449c33071a6773306928bf65960de98974a6c2afea8d81cc66e63ff70d43 
100.0% (.FLI) FLIC FLI video (1/1) 

100.0% (.) QuickBasic BSAVE binary data (1000/1) 

8c7878202c2c3059cebl3e0afd95271cc95e451fc2blff09ef6a533bc5f99450 
100.0% (.FLI) FLIC FLI video (1/1) 

466be482c0d3e4aafefd21b2183b68297610df08228e7c3449f6bc9037dld3e5 
100.0% (.FLI) FLIC FLI video (1/1) 



68dd95b4c35c9el4225930cffl771d6098df766bc77091a457dd653b07033314 
100.0% (.FLI) FLIC FLI video (1/1) 

7524a456d0257d91e3786al64129a21467ed6345fc814401elfb84609c3D679 
100.0% (.) QuickBasic BSAVE binary data (1000/1) 

4bd6d 1 a297c7be 1 3 1 3b 1 d4fce 1 2 1447e0ec43cb94ac277477fbf97c522e 1 e8e6 
100.0% (.) QuickBasic BSAVE binary data (1000/1) 

23ff44669130dl6e7dedec7eb63373fa78d003aecl058aeb8fe8ceffe3803c54 
100.0% (.) QuickBasic BSAVE binary data (1000/1) 

04aa8970c6e5da0a359a34ecab203bfb036dcl9dc2a2da065261fe2c00e7a209 
100.0% (.PGC) PGN (Portable Gaming Notation) Compressed format (1000/1) 

48dd7a482143c3124fcc588b985eca8420e6eb5ddbfe216fflc067c4f3979e45 
100.0% (.PGC) PGN (Portable Gaming Notation) Compressed format (1000/1) 

C8485c58eal51cd452b9bbc4a6b84345895f3c31156adf906b7dc3b4f669c222 
100.0% (.FLI) FLIC FLI video (1/1) 


[hide] 


»900a05880f96ebc7de [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <fc1 abl 480025947@web.oniichan.onion> 
Date: Thu Nov 24 22:1 9:07 201 6 


Using Wikileaks' address 

python get_files_in_wallet.py lHB5XMLmzFVj8ALj6mfBsbifRoD4miY36v 

1 3bd667802cc58936996dbf5defd2307b7 1 6e 1 f84a9908de0c77Gc 1 a3b4cde3 
100.0% (.FLI) FLIC FLI video (1/1) 

8218ab03d82ebfa309aceedb484e695bc058f080397d7794826c9efcld0287b7 
100.0% (.) QuickBasic BSAVE binary data (1000/1) 

c06244b 1 da9edb9da54736c 17cf8d92cc754e 1 cd 1 09c5a9858d7eb 1 07079ff3 1 
100.0% (.FLI) FLIC FLI video (1/1) 

6571600fac324166a566d4702acbd799e8e4a2f70498989cdffa204578660970 
100.0% (.VC) VisiCalc spreadsheet (1000/1) 

9d765d8074e9b85afa9f2868af61271b2043ddde365d9446c9b5afa5905d6f53 
100.0% (.PGC) PGN (Portable Gaming Notation) Compressed format (1000/1) 

05fb32e6188df3381bl9fd2cb81e5eb4c6ab0ddc885a6b3b6f87f2a5fdf4240e 
100.0% (.PGC) PGN (Portable Gaming Notation) Compressed format (1000/1) 

4a88c0c359c26fef3cc507463336alc77dl87fbc3bf7bda509fb2flb5f8762e5 
100.0% (.) QuickBasic BSAVE binary data (1000/1) 

97b2ee5fc43d24912da36ba62795884068alb0086d5c0d3d65bad5ccca637e77 
100.0% (.) QuickBasic BSAVE binary data (1000/1) 

d2be0169c5b5fccfd853a2391c6e3fc2e68a9efcbbecc842ecd98a41c58f85a0 
100.0% (.MUX) MUX video (2000/1) 



[hide] 


»7fdb66e34973aa6bb5 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <eeca31480027492@web.oniichan.onion> 
Date: Thu Nov 24 22:44:52 201 6 


Download 4a88c0c359c26fef3cc507463336a1 c77d1 87fbc3bf7bda509fb2f1 b5f8762e5 Download 

d2be01 69c5b5fccfd853a2391 c6e3fc2e68a9efcbbecc842ecd98a41 c58f85a0 

»900a05880f 
2016-10-31 01:44:57 

4a88c0c359c26fef3cc507463336alc77dl87fbc3bf7bda509fb2flb5f8762e5 
100.0% (.) QuickBasic BSAVE binary data (1000/1) 

2016-10-13 11:16:34 

97b2ee5fc43d24912da36ba62795884068alb0086d5c0d3d65bad5ccca637e77 
100.0% (.) QuickBasic BSAVE binary data (1000/1) 

2016-10-11 10:47:33 

d2be0169c5b5fccfd853a2391c6e3fc2e68a9efcbbecc842ecd98a41c58f85a0 
100.0% (.MUX) MUX video (2000/1) 


[hide] 


»ca5a801 c995fbff474 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <3639e1480029906@web.oniichan.onion> 
Date: Thu Nov 24 23:25:06 201 6 


Download 2767c5a7386aa02b973e88304bdc1 2d91 5831 46c94f90e91 075042a1 64c93d05Download 
eb75ada964677 1 a94d8c46d86f52923e2c0d2302bae73a0dda1 4ac842836f4ce 

2016-08-26 23:23:10 

2767c5a7386aa02b973e88304bdcl2d91583146c94f90e91075042al64c93d05 
100.0% (.GPG) GNU Privacy Guard public keyring (1000/1) 

2016-07-25 03:43:10 

eb75ada9646771a94d8c46d86f52923e2c0d2302bae73a0ddal4ac842836f4ce 
100.0% (.GPG) GNU Privacy Guard public keyring (1000/1) 

2016-07-25 01:08:54 


[hide] 


»98a6657a0d81 27f99b [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <fff161480034054@web.oniichan.onion> 
Date: Fri Nov 25 00:34:14 2016 



Download c336d08c199ea108cd1c9e8fb3da289fc0887e85cb9fd53cb56a0b8041d05838Download 

f6046148a74fa880403c630de743f7d01736725d941e744ce0c89baa098287ec Download 
fdfd8c3c9b535551 945645e21 2852df757763eedc2b05ae56ec6df1 beb51 1 1 05 

»7fdb66e349 

»ca5a801c99 

C336d08cl99eal08cdlc9e8fb3da289fc0887e85cb9fd53cb56a0b8041d05838 
100.0% (.DMG) Disk Image (Macintosh) (1000/1) 2016-07-24 22:30:48 

fdfd8c3c9b53555 1945645e2 12852df757763eedc2b05ae56ec6dflbeb5 11105 
100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-07-14 08:44:12 

f6046148a74fa880403c630de743f7d01736725d941e744ce0c89baa098287ec 
100.0% (.FLI) FLIC FLI video (1/1) 2016-05-24 21:39:18 


[hide] 


»e485dd840fe9f7a484 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <2a9001480035989@web.oniichan.onion> 
Date: Fri Nov 25 01 :06:29 201 6 


Download iean3.py 

»900a05880f 

»7fdb66e349 

»ca5a801c99 

»98a6657a0d 

http://gateway.glop.me/ipfs/QmZFkRKoGkv5zBVisbYvR9miGgvgEsutUnbdNXxcPbrZrZ/iean3.py 

https://codepaste.net/q893m5 

>IIRC it does what jean3.py was supposed to do. That means there's only two more scripts left to recreate all the previous steps. 
>Setting up TrID: 


>Download TrID http://markO.net/soft-trid-e.html 
>chmod +x trid 

>Download tridupdate.py http://markO.net/download/tridupdate.zip 
>python tridupdate.py 

>Setting up output: 


>mdkir dataout 
>mv trid dataout/. 

>Then use like this: 


>python jean3.py lHB5XMLmzFVj8ALj6mfBsbifRoD4mi Y36v 
>Results: 


>A11 decoded data will be in the dataout folder. lHB5XMLmzFVj8ALj6mfBsbifRoD4miY36v_file_tx_list.txt will have a list of the 
transactions and the type of file found in them. 

>Misc: 



>If you want to start at a specific page you can change 'startatpage'. It would also be very easy to start a specific date (use datel and 
date2). 

>Cheers 


2767c5a7386aa02b973e88304bdcl2d91583146c94f90e91075042al64c93d05 
100.0% (.GPG) GNU Privacy Guard public keyring (1000/1) 2016-08-26 23:23:10 

eb75ada9646771a94d8c46d86f52923e2c0d2302bae73a0ddal4ac842836f4ce 
100.0% (.GPG) GNU Privacy Guard public keyring (1000/1) 2016-07-25 03:43:10 

fdfd8c3c9b53555 1945645e2 12852df757763eedc2b05ae56ec6dflbeb5 11105 
100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-07-14 08:44:12 

C336d08cl99eal08cdlc9e8fb3da289fc0887e85cb9fd53cb56a0b8041d05838 
100.0% (.DMG) Disk Image (Macintosh) (1000/1) 2016-07-24 22:30:48 

f6046148a74fa880403c630de743f7d01736725d941e744ce0c89baa098287ec 
100.0% (.FLI) FLIC FLI video (1/1) 2016-05-24 21:39:18 

042clcd09ec672e2d504b76el6398c62396fa57ab0004a793dfc68d49d3e4cc9 
100.0% (.BS/BIN) PrintFox (C64) bitmap (1000/1) 2016-04-24 07:47:50 

83f7a29360abe4e927ae25ad803d2a28d088dll9a47941fe0c42445bb2e78730 
100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04-21 06:17:47 

ad85d76b5fd006cb3f08edda4d80327f425caed83aeb20aaa0c0ed28 1064484b 
100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04-14 19:14:05 

fa3e0d76b55e01c45dd4218a41794G9b3792310cfla88f3502824e4afc3e867 
100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04-14 02:26:40 

6ea5ff73db5259 1 66 1 ff7c0c7eb 1 6 1594b67b8e 1 29ccc2e 1429fe0c7 1 d69e 1 ff 
100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04-13 23:05:59 

35bfef9b0febbf3blcefbd8f503e90d997e55d9f3841e45f359529debd6clbca 
100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04-13 22:07:46 

7fd3 1 fccd96a3e94c2 1 dl 5b45ae 1 957c22fe5 1 al aa6cb 1 8f054bda20966304ac 
100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04-13 04:22:39 

78a013b6c857f5535b9133896d4cll5d2bbel5995a28a71f63049bf3bdcbleba 
100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04-12 22:23:58 


[hide] 


»7dcb1 1 cfa66f 1 23ce4 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <b1c6f1 480051 900@web.oniichan.onion> 
Date: Fri Nov 25 05:31 :40 201 6 


»900a05880f 

»7fdb66e349 

»ca5a801c99 

»98a6657a0d 

»e485dd840f 



2767c5a7386aa02b973e88304bdcl2d91583146c94f90e91075042al64c93d05 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1)2016-08-26 23:23:10 

eb75ada9646771a94d8c46d86f52923e2c0d2302bae73a0ddal4ac842836f4ce 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1) 2016-07-25 03:43:10 

C336d08cl99eal08cdlc9e8fb3da289fc0887e85cb9fd53cb56a0b8041d05838 100.0% (.DMG) Disk Image (Macintosh) (1000/1) 2016- 
07-24 22:30:48 

fdfd8c3c9b53555 1945645e2 12852df757763eedc2b05ae56ec6df lbeb5 11105 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-07-14 
08:44:12 

2767c5a7386aa02b973e88304bdcl2d91583146c94f90e91075042al64c93d05 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1) 2016-08-26 23:23:10 

eb75ada9646771a94d8c46d86f52923e2c0d2302bae73a0ddal4ac842836f4ce 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1) 2016-07-25 03:43:10 

eb75ada9646771a94d8c46d86f52923e2c0d2302bae73a0ddal4ac842836f4ce 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1) 2016-07-25 03:43: 10 

C336d08cl99eal08cdlc9e8fb3da289fc0887e85cb9fd53cb56a0b8041d05838 100.0% (.DMG) Disk Image (Macintosh) (1000/1) 2016- 
07-24 22:30:48 

fdfd8c3c9b53555 1945645e2 12852df757763eedc2b05ae56ec6dflbeb5 11105 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-07-14 
08:44:12 

f6046148a74fa880403c630de743f7d01736725d941e744ce0c89baa098287ec 100.0% (.FLI) FLIC FLI video (1/1) 2016-05-24 
21:39:18 

042clcd09ec672e2d504b76el6398c62396fa57ab0004a793dfc68d49d3e4cc9 100.0% (.BS/BIN) PrintFox (C64) bitmap (1000/1) 
2016-04-24 07:47:50 

83f7a29360abe4e927ae25ad803d2a28d088dll9a47941fe0c42445bb2e78730 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04- 
21 06:17:47 

ad85d76b5fd006cb3f08edda4d80327f425caed83aeb20aaa0c0ed28 1064484b 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04-14 
19:14:05 

fa3e0d76b55e01c45dd4218a41794f39b3792310cfla88f3502824e4afc3e867 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04-14 
02:26:40 

6ea5ff73db5259 1661 ff7c0c7eb 1 6 1594b67b8e 1 29ccc2e 1429fe0c7 1 d69e 1 ff 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04-13 
23:05:59 

35bfef9b0febbfiblcefbd8f503e90d997e55d9B841e45fi59529debd6clbca 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04-13 
22:07:46 

7fd31fccd96a3e94c21dl5b45ael957c22fe51alaa6cbl8f054bda20966304ac 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04-13 
04:22:39 

78a013b6c857f5535b9133896d4cll5d2bbel5995a28a71f63049bfibdcbleba 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04- 
12 22:23:58 

eb75ada9646771a94d8c46d86f52923e2c0d2302bae73a0ddal4ac842836f4ce 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1) 2016-07-25 03:43:10 

C336d08cl99eal08cdlc9e8fb3da289fc0887e85cb9fd53cb56a0b8041d05838 100.0% (.DMG) Disk Image (Macintosh) (1000/1) 2016- 
07-24 22:30:48 

fdfd8c3c9b53555 1945645e2 12852df757763eedc2b05ae56ec6dflbeb5 11105 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-07-14 
08:44:12 

f6046148a74fa880403c630de743f7d01736725d941e744ce0c89baa098287ec 100.0% (.FLI) FLIC FLI video (1/1) 2016-05-24 
21:39:18 

042clcd09ec672e2d504b76el6398c62396fa57ab0004a793dfc68d49d3e4cc9 100.0% (.BS/BIN) PrintFox (C64) bitmap (1000/1) 
2016-04-24 07:47:50 

83f7a29360abe4e927ae25ad803d2a28d088dll9a47941fe0c42445bb2e78730 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04- 
21 06:17:47 

ad85d76b5fd006cb3f08edda4d80327f425caed83aeb20aaa0c0ed28 1064484b 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04-14 
19:14:05 

fa3e0d76b55e01c45dd4218a41794B9b3792310cfla88B502824e4afc3e867 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04-14 
02:26:40 

6ea5ff73db5259 1661 ff7c0c7eb 1 6 1594b67b8e 1 29ccc2e 1429fe0c7 1 d69e 1 ff 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04-13 
23:05:59 

35bfef9b0febbfiblcefbd8f503e90d997e55d9B841e45fi59529debd6clbca 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04-13 
22:07:46 

7fd31fccd96a3e94c21dl5b45ael957c22fe51alaa6cbl8f054bda20966304ac 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04-13 
04:22:39 

78a013b6c857f5535b9133896d4cll5d2bbel5995a28a71f63049bfibdcbleba 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-04- 
12 22:23:58 

aa3bf652dc745e8al265c3641858e9a75e4cd3ee85eb843033b4302e2dec5fc7 100.0% (.FLC) FLIC FLC video (1/1) 2016-04-06 
05:53:04 



b4c38335541fd578bdc4d45ala4a47e3baadd2a55ae41c0e5535eb4307d49b24 100.0% (.PGC) PGN (Portable Gaming Notation) 
Compressed format (1000/1) 2016-03-18 18:12:19 

b20ad5f8b75bael6a6dle3de2fb25910be868f936a6e3cc3d997598dcedl4f89 100.0% (.FLI) FLIC FLI video (1/1) 2016-03-15 
21:19:44 

24b0967ecca36dd455b9a96e48d8c0fl3a36acdd37290f6baae3c50b7065627e 99.9% (.MP3) MP3 audio (1000/1) 2015-11-28 
09:53:31 

32d71a560a965fel7ca5a652202844f5bb580dl85e38485aacad8717485b0b8e 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2015-11- 
20 21:53:12 

03e8a9bl 197744012af33c642671ed8eb50fd2d442d4875a3274f730ac2ca951 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2015-11- 
19 22:16:50 

2a38f95db552a52aefa82565ffd81e885103738da25627fle894f5892a672325 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2015-11-12 
18:27:54 

15d4f6606f7ad966e27f9628acf3cl929eb50cb2fef0ecb949fb8941b94254cc 100.0% (.MP3) MP3 audio (1000/1) 2015-11-06 10:47:37 
13bd667802cc58936996dbf5defd2307b716elf84a9908de0c77f3cla3b4cde3 100.0% (.FLI) FLIC FLI video (1/1) 2016-11-21 
18:23:36 

8218ab03d82ebfa309aceedb484e695bc058f080397d7794826c9efcld0287b7 100.0% (.) QuickBasic BSAVE binary data (1000/1) 
2016-11-15 19:41:03 

C06244blda9edb9da54736cl7cf8d92ec754elcdl09c5a9858d7ebl07079ff31 100.0% (.FLI) FLIC FLI video (1/1) 2016-11-09 
18:46:55 


[hide] 


»b92f6d1 59d2dcc0b1 6 fRepIvl 
Subject: None 
Name: Anonymous 

MessagelD: <ce9a61 48009841 4@2hu.tld> 
Date: Fri Nov 25 1 8:26:54 201 6 


Download wikileaks-did-91 1 .jpg 


Even if the keys were released, where would you post any information about the contents of the files. No place exists that is not a 
controlled, opposition space. 

Facebook, Twitter, Reddit? You get the idea. The whole internet is built on backdoored standards. The existing internet is completely 
corporate controlled and in the hands of the enemy. 

We have seen evidence of websites being intercepted and content being removed in real time. They will let some leaks out, but there is 
not a channel for mass dissemination and media for this type of leak. 

- The insurance files should be downloaded quitely to as many people as possible. 

- We should verify the hashes of the wikileaks files (multiple hashes and verifications). Expecially for the newer files and the saudi 
file that was modified 

- We should build up or fortify our distribution system for messages 

- We should build up a toolchain for writing messages to the blockchain and retrieving the messages (as a stop gap in case Bitmessage 
comes under complete exploitation) 

- The enemy has a nuke button and can dump 10 GB per day into bitmessage and make it unusable if needed 

- We should prepare for the private key distribution (which is expected to happen by Christmas if it has not already happened) 

- We should each individually be able to decrypt the files. We should not expect that the files will be allowed on websites or public 
internet 

- If we cannot post files on Bitmessage and the clearnet is jammed, how will we even distribute the worst of the files? We wont be 
able to. Each person needs to get the files themselves, decrypt them and may have to do sneakernet or we may have to distribute the 
worst information on USB sticks. 

- We need tools to posting to the blockchain as a last resort 

Sending a message on the blockchain may cost us 10 cents or $5 but if it is important enough, that may be the only way. 

In the long term, we need to develop new media platforms and communication platforms that are more resilliant. 

- more difficult to jam 

- more difficult to modify content once published 



- ability to detect jamming if it is occuring. 

We need distributed blogging and messaging platforms. We need a safe and secure way of distributing files. 


Hi everyone. 

I realize that this message might not go through but just in case — this will be my final message sent to BM. Anyone claiming to be 
updating my situation is lying. 

I've been working with another person on this since the original thread in October 17. This is our third attempt at spreading the 
information. I don't think it will be possible for anyone to upload the keys and the files. It really seems like the only way is for 
everyone to get them from the blockchain separately. Some of you might think this is not the case but you'll be able to see it first hand 
when you try soon. It should be fairly straight forward for everyone to extract the keys and files with the information on this BM. 

On our end, we can confirm that the script can be used to extract the following files: 

2016 Disk Image, Spreadsheet, BIN, multiple videos, mp3s, emails, pdf documents 
2015 Disk Image, Spreadsheet, multiple videos, mp3s 
2014 Disk Image, Spreadsheet, multiple videos 
2013 several backups in zipfiles 

Hash and time stamp text for what seems like all uploads to Wikileaks.org 

The following files can be unlocked so far: 

20 1 6-06-03_insurance . aes256 . torrent 
wlinsurance-20 1308 1 5- A. aes256 
wlinsurance-20 1308 1 5-B .aes256 
wlinsurance-20 1308 1 5-C. aes256 

We have not been able to unlock: 

2016-11 -07_WL-Insurance_U S . aes256 
2016-11 -07_WL-Insurance_UK. aes256 
2016-11 -07_WL-Insurance_UK. aes256 
wikileaks-insurance-20120222.tar.bz2.aes 

Allegedly unlocked by others: 

2016-06-03_insurance.aes256 

wikileaks-insurance-20120222.tar.bz2.aes 

There is clearly a lot more information that we haven't gotten to yet. 

The file pieces have to be combined so a bit more code is needed. The Cablegate Backup should be used as an example to do it. Some 
groups are now going through the same issues we've seen. Our experience was that we lose internet connection, we are unable to copy 
paste or keep anything on our clipboards, all attempts at encoding transactions into BTC get delayed and do not happen, files on 
computers connected to the Internet are deleted or moved, etc. That is why I think the best way to spread this is to teach others how to 
do it and possibly to encode what you feel comfortable making permanent in some crypto currency other than BTC. 

I expect that in the next few days the media will be forced to cover this. The spin will be that these files cannot be verified, do not 
come from Wikileaks and that no one can recreate the steps to get them. They will probably push false steps that do not work. From 
what we have seen, most people will not bother to check and believe it. Because the blockchain is permanent and many have copies, I 
do not think that it will be possible to spin this in this way forever. Anyone can do it in their own homes. However, they have been 
preparing for this for months. Damage control will be very easy for them because there are really no sites that can be used to discuss 
this anymore. I'm a still a bit concerned because the steps on how to get the information were available since mid October and very 
few people tried to do it. It was practically impossible for us to try to discuss this with others on any site. Everyone seems to react 
violently to the suggestion but I am not sure if these were even real responses. 

The easiest way to collect the information is on a computer that is not connected to the internet and has no wifi cards. Making a 
database with relational information of the transactions helps a lot as well. It might be necessary for someone to create a very easy to 
follow tutorial with code that allows anyone to do this. To this day many people refuse try on their own and simply chose to believe 
that it is not real. If you care about this, you should spend some time showing people the evidence and guiding them through of 
process of getting the files themselves. 



My personal opinion is that the most crucial thing that should happen when this is finally out in the open is that the people pretending 
to be Wikileaks should be exposed. It should be clear to everyone that people are paying attention. The people that sold out and did as 
they were told should also be exposed. I still don't understand why it was so easy to get most people to play along and allow their sites 
to be controlled. It is alarming that talking about this is practically forbidden everywhere. During the past few months we have 
witnessed a possible end of a free internet. People in power have the resources to fool the entire world into agreeing with them through 
censorship, paid posts, hots, etc. There is not even a way to verify the history of a page anymore since they now control the only site 
that allowed it. I think this is the perfect opportunity to guarantee that this is stopped and does not happen again. However, everyone 
should see the information and decide by themselves what they want to do. 

Thanks to all of you that helped. 


[hide] 


»1 6f958062f803b301 a [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <1 87061 480098491 @2hu.tld> 
Date: Fri Nov 25 18:28:11 2016 


Download 575d62996a272d1 efl 44f 1 ab65c4ec793cd6c7e564db409bb00e41 686521 991 6.pnq 

»b92f6d!59d 

Join LARP chan! BM-2cX3hsRXiz3WxF6HMNQutkLAzC34feswfa and participate in our "conspiracy fighting" with elements of 
MMOARG :) 

If you want to play one of these games: 

"I found keys to WikiLeaks insurance files" 

"Someone found keys to WikiLeaks insurance files" 

"Someone have hidden keys to Wikileaks insurance files" 

"There are messages/keys hidden in blockchain" 

"I just created a nice C/C++/C#/Python/Ruby/bash/DOS batch/Turbo Pascal code to read secret messages from blockchain! Check it 
out!" 

"People are disappearing!" 

"I found secret messages in {someone} tweets!" 

"NSA is disrupting my internet connection" 

"NSA is censoring things in realtime!" 

"A cat from embassy is telling me things" 

"Assange is dead" 

"Assange is kidnapped" 

"I found magic bug in OpenS SL which breaks all SSL crypto!" 

"We need to communicate by secret SHA256 chans" 

then join LARP today! This chan is for you and all your conspiracy/LARP needs! 

BitMessage channel: Address: BM-2cX3hsRXiz3WxF6HMNQutkLAzC34feswfa Name:LARP 


[hide] 


»ad9a49d3e5e41eec4c [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <9f041 14801 02525@web.oniichan.onion> 



Date: Fri Nov 25 1 9:35:25 201 6 


»16f958062f 

>To everyone reading this. This place is now full of shills in damage control mode after last night. 

>Trust nothing you read here. If you truly care about this issue, go verify the information yourself. This is why it was designed in this 
way. No one can make any statement about what's in it unless they decoded it themselves. 

>Wikileaks has a time stamp and hash for every single file they publish. If you think this is a lie, listen to Assange himself saying it: 
https://www.youtube.com/watch?v=MaB3Zw5_p9c&feature=youtu.be&t=7m06s Or even better go look in the blockchain and see for 
yourself. 

>When you see this in the blockchain you will see that what people have been trying to communicate to you last night is real and that 
you can verify it. 

>TRUST NO ONE AND USE THE SYSTEM THEY PUT IN PLACE AS IT WAS MEANT TO BE USED. ZERO SPECULATION 
AND OPINIONS. PROVABLE FACTS THAT ARE PERMANENT AND CAN’T BE CHANGED. 


[hide] 


»2dc8fe1fd9fdfd8a72 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <15ea41480104800@web.oniichan.onion> 
Date: Fri Nov 25 20:1 3:20 201 6 


For publishers for example, so that, as an example we are starting to use Bitcoin, Wikileaks, stuffing our, cryptographic keys of stuff 
that we publish, so, '"we prove that we have published stuff at a particular time by stuffing it in Bitcoin, in the blockchain'", and then, 
'"if someone were to come and try to modify the material that we have published" 1 , to take a particular part, ’"that would be 
detectable’". -Julian Assange 

https://www. youtube. com/watch?v=MaB3Zw5 p9c&feature=youtu.be&t=7m06s 

Anyone that is skeptical of the information you have extracted from the blockchain is only attempting to discredit you. Every person 
that truly cares about verifying this information does not go online to ask others. Those who want real evidence go and verify it 
themselves. This is the way the system was meant to be used. You have the blockchain. You have direct access to the information. 
There is no need for opinions, speculations, reports, or analysis by other parties. The only evidence that matters is the evidence you, 
the reader, are able to test on your own. The system helps you detect the people that are attempting to influence you. If you need to ask 
others how to obtain the information you are admitting that you do not want to independently verify this information and are instead 
dependent on others. This dependence on others is what allows censorship and it is precisely the reason information is encoded in this 
way. If someone tells you they were not able to find anything you can prove that they are lying. You have a permanent source of 
information that can not be modified. Use it as it was designed to be used. 


[hide] 


»c305652abf50431 b22 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <976a71480107590@web.oniichan.onion> 
Date: Fri Nov 25 20:59:50 2016 


Download critical-thinking. png 

"The code in there is not meant for people to use it. It is meant for people to understand how to do it. It’s a proof of concept. Again, 
stop depending on others. That's why the information is encoded in this way, so that no one can discredit it and everyone can verify it. 



If the keys somehow survived here. EVERYONE would stop looking at the blockchain (which has a lot more than the keys in it, 
including evidence that todays leaks are fake). Most of you probably have version of the insurance files that have been modified and it 
would be very easy for someone to send out a key that can be used for these fake files. Then, they will be able to discredit Wikileaks. 


If you have found the keys you will have also found out that the instructions tell you specifically to NOT SPREAD THE KEYS 
directly. 


The system was designed so that everyone independently extracts them from a permanent source of data that cannot be modified. 


Be logical about this. They put a lot of work into this system and it's the ONLY reason no one has come out with fake keys for fake 
files. Because the blockchain TELLS YOU that if you see a key it is not real. 


How has no one figured this out... For fucks sake. " 


[hide] 


»58a1 al 37adc3b774f5 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <7b3ae14801 12925@web.oniichan.onion> 
Date: Fri Nov 25 22:28:45 201 6 


»16f958062f 

idk why but I fuckin lost it on Turbo Pascal 


[hide] 


»6ee231 3bee46ef02dd [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <8344b14801 14498@web.oniichan.onion> 
Date: Fri Nov 25 22:54:58 201 6 


>4. This address might be worth investigating: 

https://blockchain.info/address/lNquFlc4AuKx9YJtP9SsjGqhazfa72yPBM?offset=100&filter=0 Many OP_RETURNs and all on the 
10/16/2016 within a period of a few hours. I have not had the chance to investigate further. 

I am getting 24 file headers, including 3 GPG keyrings, all from from 10/16. It would be interesting to see if these headers are also 
found in other wallets. 

Here are the headers I found: 

Ibeb3fa9277841 18bad5984e6902268c9bacfcea8973el971c2812159939a852 100.0% (.SGF) Smart Game Format (2000/1) 2016-10- 
16 20:41:17 

d2c78418097800a2b91130d97e48bd6al3241a50f5a96196f2dec7bl3a7619fc 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1)2016-10-16 20:41:17 

0bf3fc7ce906fc370f08e3ced24612d8b8cb75be7633ff69d8d968cf9c2945f5 100.0% (.INI) Generic INI configuration (1000/1) 2016- 
10-16 20:41:17 

7666d77230972d96e64dc68bf8855de235bcc34ealbal63245eda28bb6d518d6 100.0% (.PCI) DEGAS low-res compressed bitmap 
(2000/1) 2016-10-16 20:41:17 

C2a6af758fl64ab546942ac859c85e6ba44b983ba60197d8fd0060b00bdd5acc 100.0% (.INI) Generic INI configuration (1000/1) 2016- 
10-16 20:41:17 

2a9553a298deel48e6ba318f00ebcd43f66da582f0bf22c2726e5a81905f85ea 100.0% (.BS/BIN) PrintFox (C64) bitmap (1000/1) 2016- 
10-16 20:41:17 



72d398423cfd078b711dde5bf04557f5efc9f6dd0b5e4caf2721cb4e01dd95fl 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-10-16 
20:41:17 

b9d065flaa82d6894eca3ec6e4ee0a685b060579802376f5bl9cd3fl6add9969 100.0% (.DMG) Disk Image (Macintosh) (1000/1) 2016- 
10-16 20:41:17 

95f095flf40bc9097f21953e7d975b8a3ec0e35fla6c877fcf2d2a606dafaabb 100.0% (.MP3) MP3 audio (1000/1) 2016-10-16 20:41:17 
878785a920238977bb9073ac306c032177c05d3147f8107e0fe335elac71eaa0 100.0% (.) QuickBasic BSAVE binary data (1000/1) 
2016-10-16 20:41:17 

a4a9bf 14d0bc5 1 2baf 1 9a8b65a2ce 1 cdc938dd95 1 56202fad9d 1 14e52c37 1 a97 100.0% (.FLI) FLIC FLI video (1/1) 2016-10-16 
20:41:17 

2al0bfb8eea8blbl4eb6ec5dl028375e3dcle8df613128a4c4e0826blb593370 100.0% (.) Java serialized data (2000/1) 2016-10-16 
19:52:34 

bd208e22086a014dabc048d8164ad7e9b9c25a0d7f9efca784577237fe67b737 100.0% (.FLC) FLIC FLC video (1/1) 2016-10-16 
19:52:34 

bb9cbfa2d2dff67704183b69d36dd286aecd51c4e2e6f696bb6al09bc50blaf9 100.0% (.DMG) Disk Image (Macintosh) (1000/1) 2016- 
10-16 19:52:34 

fd73c71bf2f9ddd25d4f95170a5de307219910a69cb99559308aebc3a457aldf 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1) 2016-10-16 19:52:34 

f25affb9cc5d71b436d947f8a3e4efl3acd5101df8bdl23170d846d213aela58 100.0% (.) QuickBasic BSAVE binary data (1000/1) 
2016-10-16 19:52:34 

eed41738ff541ff4aeeb9c0d31G3896dbdf8cl85301326af4ea857564fae918 100.0% (.FLI) FLIC FLI video (1/1) 2016-10-16 19:52:34 
382caa3a30147238aae98db65e7126ce418493ac044d239b208aa2bldf2b64ae 100.0% (.MP3) MP3 audio (1000/1) 2016-10-16 
19:52:34 

f9156aeaae48b080ee74febd0cbbed2f948fe207e6e72132bf3b3db5f3952575 100.0% (.PGC) PGN (Portable Gaming Notation) 
Compressed format (1000/1) 2016-10-16 19:52:34 

56747b8f00b40dlf0a577e0flc38d3fe6f776ffba91827a43951fca75ddb5ce4 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1) 2016-10-16 19:52:34 

C352d9c251fl7afe03f950dfa0e876d77blf8be61b3713aa2f0168880824b3ea 100.0% (.MP3) MP3 audio (1000/1) 2016-10-16 19:46:25 
e893933b297a9a636528alaabe0c427e2317dfc2bc220271ccf31246bafl07df 100.0% (.FLI) FLIC FLI video (1/1) 2016-10-16 
19:46:25 

d28b23830bf810684722c72af4e7e573c89adc77e571b2ae6095deb35dfl a8de 100.0% (.DMG) Disk Image (Macintosh) (1000/1) 2016- 
10-16 19:46:25 

b549bf3d045f87ce766eb50bla64a6843ae8267ece3a383b70bb7d273b860065 100.0% (.MP3) MP3 audio (1000/1) 2016-10-16 
19:46:25 


[hide] 


»2f249cbf02eb3ad90a [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <8557714801 16288@web.oniichan.onion> 
Date: Fri Nov 25 23:24:48 201 6 


>When you scan by transactions, you look for a transaction number (tx id), and decode its contents. When you know the tx id, you can 
easily see which wallets were involved. Some messages require you to combine the decoded data from multiple tx ids. You can 
identify which tx ids are relevant by looking at transaction histories of the wallets involved. This strategy is used for the 'Cablegate 
Backup'. In that case, the list of tx ids is directly told to the readers in the first message. However, you can compile this list on your 
own by 'tx crawling'. To do this, follow these steps: 

>. For each tx, look at the wallets that received money and find those that spend it (in this case it is only one per tx). 

>. For that wallet, look at its transaction history and find a transaction that follows a similar pattern, i.e., it involves multiple wallets 
and only one spends the funds. 

>. Continue doing this until you are not able to see the pattern repeat itself. 

Confirming that jean3 is able to find the 7-zip headers for the cablegate addresses. 

python jean3.py lNT3ACYygZj9YHYsZo7hp2jGEPiUDMqs53 
python jean3.py 1 AuoHX7 VNGGK5 KkkU cB AGG3 RuKgMuRdpMB 
python jean3.py lMe9i8XjbdBVZzgcki4NiPdF6VkYf75ykZ 

All find 1 file header. 



100.0% (.7Z) 7-Zip compressed archive (6000/1) 

(First tx is 5c593b7b71063a01f4128c98e36fb407b00a87454e67b39ad5f8820ebclb2ad5) 


[hide] 


»1 0eb7096735598064c [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <3099d14801 17340@web.oniichan.onion> 
Date: Fri Nov 25 23:42:20 201 6 


Download iean3.py 
»2f249cbf02 


[hide] 


»9a8c6371 2e6799aadb [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <78e1e1480132954@web.oniichan.onion> 
Date: Sat Nov 26 04:02:34 2016 


Download 276.qpqDownload cce.qpqDownload eb7.qpqDownload 737.qpqDownload d3c.qpq 
Here are the two gpg keyrings in the WL wallet in case anyone wants play with them. 

(From txs 2767c5a7386aa02b973e88304bdcl2d91583146c94f90e91075042al64c93d05 and 
eb75ada9646771a94d8c46d86f52923e2c0d2302bae73a0ddal4ac842836f4ce) 

http://gatewav.glop.me/ipfs/QmS3zs98mFmvqGdxRaUCrx3e42UsLXQ6VfRpSXrKrk8SAZ/276.gpg 

http://gatewav.glop.me/ipfs/Qmaol2d6tWhl5bA5mUYQlpcoTaiMcvb85SNyzrsS25wpFa/eb7.gpg 

To print all the packets do: 

for i in { 1 ..293 } ; do echo "Trying bytes: $ { i } " ; tail -c "+${i}" eb7.gpg I gpg -list-packets; done 
for i in { 1 ..9993 } ; do echo "Trying bytes: $ { i } " ; tail -c "+${i}" 276. gpg I gpg -list-packets; done 

and here's three T00.0% (.PGP/GPG) PGP symmetric key encrypted message (salted+iterated)' encoded after the Cablegate backup. 
(From txs: 

7379ab5047bl43c0b6cfe5d8d79ad240b4b4f8cced55aa26f86dld3d370c0d4c 
d3c 1 cb2cdbf07c25e3c5f5 1 3de5ee3608 1 a7c590e62 1 f 1 f 1 eab62e8d4b50b635 
Cce82f3bde0537f82a55f3b8458cb50d632977f85c81dad3el983a3348638f5c) 

http://gatewav.glop.me/ipfs/QmShQicUaKagC6hXzXqCdtRvP8pAXfBkiP5C51XsZVZg2e/737.gpg 

http://gatewav.glop.me/ipfs/OmZxXabEusrSK4e9esLGJY7YAqLxxXhXPCyXhNWcnEVQH9/cce.gpg 

http://gateway.glop.me/ipfs/QmcnVecuQtobYWUkhUHGFLVAzfokQRRYsWKS2iV8bJwsic/d3c.gpg 


[hide] 


»e5b3b010e05ac1fd05 [Replvl 
Subject: None 



Name: Anonymous 

MessagelD: <e73da1480206884@web.oniichan.onion> 
Date: Sun Nov 27 00:34:44 201 6 


Download code.7z 
Code zip: 

http://gatewav.glop.me/ipfs/OmVlZ8kXBFZrLtsGTxTaB9HS6TTDURa27vyFJfAoiJi5wH/code.7z 
To compile: 

gcc bcrdr2.c sha256.c ripe 160. c -lsqlite3 -o bcrdr2 
To Run: 

./bcrdr2 <blocks dir> <database file> 
e.g: 

./bcrdr2 -/.bitcoin/blocks/ out.db 


WHAT IT DOES: 


This program reads through every file named blk*.dat in the folder to point it at and parses it. 
It creates an sqlite3 database with the following schema: 


CREATE TABLE BLOCK(" 

"ID INT PRIMARY KEY 


NOT NULL," 
NOT NULL," 
NOT NULL," 
NOT NULL," 


"PREV CHAR(64) 

"MERKLE CHAR(64) 

"HASH CHAR(64) 

"NUM INT 

"BITS INT NOT NULL," 

"NONCE INT NOT NULL," 

"TIME INT NOT NULL);"; 


Block header info, including the computed double SHA256 hash for the block. 

PREV is previous block hash, MERKLE is the merkle root hash, HASH is this block's hash. 
The other fields are miscellaneous. 


"CREATE TABLE TX(" 

"ID INT PRIMARY KEY NOT NULL," 

"HASH CHAR(64) NOT NULL," 

"FILE TEXT NOT NULL," 

"OFFSET INT NOT NULL);"; 

Transaction header. 

HASH is this transaction's SHA double hash. 

FILE is the .DAT file's ID that it came from (See the FILE table below to get the file's name) 
OFFSET is the offset in the file it came from. 


"CREATE TABLE TX_INPUT(" \ 

"ID INT PRIMARY KEY NOT NULL," \ 

"TX INT NOT NULL," \ 

"PREV CHAR(64) NOT NULL," \ 
"DATA BLOB NOT NULL," \ 

"IDX INT ," \ 

"SEQ INT );"; 


Input transaction. Here for completeness, not really useful unless you want to verify transactions. (We don’t) 
TX is the transaction it's part of 



PREV is the previous transaction 

DATA is the raw script data. 

IDX and SEQ are misc fields. 

"CREATE TABLE TX_OUTPUT(" \ 

"ID INT PRIMARY KEY NOT NULL," \ 

"TX INT NOT NULL," \ 

"DATA BLOB NOT NULL," \ 

"ADDR TEXT ," \ 

"VAL BIGINT 

Output transactions. 

TX is the transaction it's part of. 

DATA is the raw script data. 

ADDR is the transaction address the program tried to figure out given the script in DATA. 

VAL is the bitcoin amount in it's raw format (integer) 

"CREATE TABLE FILE(" \ 

"ID INT PRIMARY KEY NOT NULL," \ 

"NAME FILE NOT NULL);"; 

FILE is the table that simply assigns an ID to each file name for reference in the table above. 


These are relational tables to quickly find parent child relationships, i.e. What TX has what INPUT and vice versa. 

"CREATE TABLE REL_BLOCK_TX(" \ 

"ID INT PRIMARY KEY NOT NULL," \ 

"BLOCK INT NOT NULL," \ 

"TX INT NOT NULL);"; 

Table for Block Transactions 


"CREATE TABLE REL_TX_INPUT(" \ 

"ID INT PRIMARY KEY NOT NULL," \ 

"TX INT NOT NULL," \ 

"INPUT INT NOT NULL);"; 


Table for Input Transactions 


"CREATE TABLE REL_TX_OUTPUT(" \ 

"ID INT PRIMARY KEY NOT NULL," \ 

"TX INT NOT NULL," \ 

"OUTPUT INT NOT NULL);"; 


Table for Output Transactions 

These two aren't used yet, but were intended for linking blocks in a chain (not really needed since all we care about are the 
transactions themselves) 


"CREATE TABLE REL_BLOCK_NEXT(" \ 

"ID INT PRIMARY KEY NOT NULL," \ 

"BLOCK INT NOT NULL," \ 

"NEXT INT NOT NULL);"; 

"CREATE TABLE REL_BLOCK_PREV(" \ 

"ID INT PRIMARY KEY NOT NULL," \ 

"BLOCK INT NOT NULL," \ 

"PREV INT NOT NULL);"; 


I hope my program can be of use to you. You are welcome to share it as needed. 



[hide] 


»9ae31 41 e5e4605951 c [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <bcb791480227443@web.oniichan.onion> 
Date: Sun Nov 27 06:1 7:23 201 6 


>trid marked two transactions as pgp private keyring files between 383000-383100: 

>f286e28e6 1 3fc341f3 1 843200fef9f3f 1 1 9783c249f8662cd04 1 75 1 2c3dbd96 1 
>100.0% (.SKR/GPG/PGP) Pretty Good Privacy (PGP) Private/Secret Keyring (v2) (1001/2) 
>Tue Nov 10 00:00:00 2015 
>from block 383001 

>ca3044870b86fef3f3e8d559c81368646f8393667caddla4fc3eb8b212ac3fbe 
>100.0% (.SKR/GPG/PGP) Pretty Good Privacy (PGP) Private/Secret Keyring (v4) (1001/2) 
>Wed Nov 1 1 00:00:00 2015 
f>rom block 383073 


[hide] 


»cf0c0459de720ea5d4 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <fe69c1 480229499@web.oniichan.onion> 
Date: Sun Nov 27 06:51 :39 201 6 


OP_RETURNS search: 
https://www.smartbit.com.au/op-returns 


[hide] 


»e816fb0fe644dcffa7 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <988de1 480231 053@web.oniichan.onion> 
Date: Sun Nov 27 07:1 7:33 201 6 


Download 7b4 

>From Wikileaks: 

>7b42129c959b7db85688c5c686cl7eabdal0156138d96fb738fb8f0513dl34af 
>100.0% (.GPG) GNU Privacy Guard public keyring (1000/1) 2016-11-11 17:29:06 


>Good call. We need to run jean3.py again with this change. 

>http://gateway.glop.me/ipfs/QmV7RPtEAkBmXMRgs61rWAKbhLlH3WNMa87Ujlx6bpRTl l/jean3_8fix.py 


>1 actually am decoding them slightly differently. Scripts floating around remove the first 8 bytes as per the satoshi downloader. i 
don't remove them unless they are a valid checksum for the rest of the data. 



[hide] 


»1 b5c5a1 2c8b1 Obi e4f [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <00649148023121 6@web.oniichan.onion> 
Date: Sun Nov 27 07:20:16 201 6 


Download iean3 8fix.py 
»e816fb0fe6 


[hide] 


»f2cd75db8f4e0443ce [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <5d09b1 480231 694@web.oniichan.onion> 
Date: Sun Nov 27 07:28:14 201 6 


»e816fb0fe6 

»lb5c5a!2c8 

>If you use jean3_8fix.py you are not able to detect the cablegate header. It seems like the proper thing to do would be to do 'trid' 
every 8 bytes but that would give us a lot of false positives. 

>In simple terms, some files have the headers in the first 8 bytes, others have it in the first 16. We don't know if some headers could 
be in other parts of the file. 

>Anyone have any ideas? 


[hide] 


»4f7de4ceb69972f1 b6 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <756a01 480231 823@web.oniichan.onion> 
Date: Sun Nov 27 07:30:23 201 6 


Download 259.gpg 

»e816fb0fe6 
>Another from Wikileaks: 

>2593dbef02eeb4c7528773b0bdf0a4aba35ae3471bl07dee49886f8fe894flf0 
>100.0% (.GPG) GNU Privacy Guard public keyring (1000/1) 2016-10-31 19:41:29 


[hide] 


»6edd09ce1 41 0c71 1 3c [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <578831 480232231 @web.oniichan.onion> 




17a65dac7d411e6151631025c3b9ab22cf87d6dd4cad67a097903152dab4ab93 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1)2016-10-11 20:28:11 


[hide] 


»b68554ffbd80887cb0 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <fc8691 480232396@web.oniichan.onion> 
Date: Sun Nov 27 07:39:56 201 6 


Download 15d.qpq 

15dde0ff8e9e213ed20acdb01e3c58faad7491c6f3a93cdc54dba055b45b7371 
15dde0ff8e9e213ed20acdb01e3c58faad7491c6f3a93cdc54dba055b45b7371 
100.0% (.GPG) GNU Privacy Guard public keyring (1000/1) 2016-07-27 13:21:06 


[hide] 


»3d4c82adf2e58aa4f6 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <60ecb1 4802341 93@web.oniichan.onion> 
Date: Sun Nov 27 08:09:53 201 6 


»e816fb0fe6 

»lb5c5a!2c8 

»f2cd75db8f 

»4f7de4ceb6 

»6edd09cel4 

»b68554ffbd 

Here's what I get so far (using the first 8 bytes for trid) from the Wikileaks address: 

GPG keyrings: 

7b42129c959b7db85688c5c686cl7eabdal0156138d96fb738fb8f0513dl34af 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1) 2016-11-11 17:29:06 

2593dbef02eeb4c7528773b0bdf0a4aba35ae3471bl07dee49886f8fe894flf0 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1) 2016-10-31 19:41:29 

17a65dac7d41 Ie6151631025c3b9ab22cf87d6dd4cad67a097903152dab4ab93 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1)2016-10-11 20:28:11 

15dde0ff8e9e213ed20acdb01e3c58faad7491c6Da93cdc54dba055b45b7371 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1) 2016-07-27 13:21:06 

Everything else: 



7b42129c959b7db85688c5c686cl7eabdal0156138d96fb738fb8f0513dl34af 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1)2016-11-11 17:29:06 

d3d9c958802cdfd30ccbab2a3e3e73a20el Ic767d4ac32e65e6ecc71d6fd4f09 100.0% (.INI) Generic INI configuration (1000/1) 2016- 
11-09 06:34:54 

83dd30fbba775cbddbd6b624c41b95b43b483a99a6272flc8653238clba76238 100.0% (.PGC) PGN (Portable Gaming Notation) 
Compressed format (1000/1) 2016-11-07 18:47:52 

2593dbef02eeb4c7528773b0bdf0a4aba35ae3471bl07dee49886f8fe894flf0 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1)2016-10-31 19:41:29 

4cc85ec53bccld8860bae3e4454f5fe6cala8b6cdd3dc3eeel57e56dad98697a 100.0% (.MP3) MP3 audio (1000/1) 2016-10-22 
03:53:51 

a062037cde0bcca042ad5f636fb3820f9fce2c2383b40e885240635df3339e74 100.0% (.MP3) MP3 audio (1000/1) 2016-10-21 
15:47:59 

f42 1577f8aedcb2 Ie9855al5 13fff37a0f03d79097df323f8d5c33fd8 16701 5f 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-10-19 
16:23:26 

7fce28afdaa30all9091ab34b0786588ce3f9fl0f211882abc3faac82dd3cb61 100.0% (.BS/BIN) PrintFox (C64) bitmap (1000/1) 2016- 
10-17 20:00:56 

faf4edf7f6d6b6438d08658b0edc3cf968beab4ac4e7dbd478daa6bbbbfffef8 100.0% (.) QuickBasic BSAVE binary data (1000/1) 2016- 
10-17 17:20:28 

17a65dac7d411e6151631025c3b9ab22cf87d6dd4cad67a097903152dab4ab93 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1) 2016-10-11 20:28:11 

d8d 1 a7 1 2d5eb8ad7 a2a0c90d2c97f8 11331 2bda2b35e5636f0e5d 1 6e0888dd96 100.0% (.YZ1) Deep Freezer compressed archive 
(2000/1) 2016-08-10 22:44:26 

bade24ed0c7d2caa554fld3b2c547a0ab727170blb2a284f794c25004ed533ce 100.0% (.) QuickBasic BSAVE binary data (1000/1) 
2016-07-29 21:15:05 

15dde0ff8e9e213ed20acdb01e3c58faad7491c6Da93cdc54dba055b45b7371 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1) 2016-07-27 13:21:06 

a2f7fc08979626de88d07a464d74910f37d5068662bf6854be5150aa522eb510 100.0% (.PGC) PGN (Portable Gaming Notation) 
Compressed format (1000/1) 2016-07-23 17:54:53 

7a98alb62cc98ddfa4501a53f74c4d2c56421eae2feae73a2d9d8510c391851 1 100.0% (.PGC) PGN (Portable Gaming Notation) 
Compressed format (1000/1) 2016-06-03 22:46:47 

f6046148a74fa880403c630de743f7d01736725d941e744ce0c89baa098287ec 100.0% (.INI) Generic INI configuration (1000/1) 2016- 
05-24 21:39:18 

aaa8e20d83bb8328e6c2dd32dbd75735dbcb68866663e5al086de9eb52dllaa7 100.0% (.PGC) PGN (Portable Gaming Notation) 
Compressed format (1000/1) 2016-05-06 10:26:07 

042clcd09ec672e2d504b76el6398c62396fa57ab0004a793dfc68d49d3e4cc9 100.0% (.DMG) Disk Image (Macintosh) (1000/1) 
2016-04-24 07:47:50 

Idc6ed6ceb0bf486bf9f2d41d5f627e34b6d237503a4bl379c2eefb45804alc9 100.0% (.BS/BIN) PrintFox (C64) bitmap (1000/1) 2016- 
04-13 03:04:41 

abd836e3a9becfdl273el21e4a91e6f6bfl0727ff73e0aa2ee563dde84696125 100.0% (.DMG) Disk Image (Macintosh) (1000/1) 2016- 
04-12 11:55:14 

9fbb0d75f5b57954db908c06a33646fe5f34678314bfladdd8ee26247dbcc549 100.0% (.) QuickBasic BSAVE binary data (1000/1) 
2016-02-29 06:09:12 

e551cbd5f42bbafa81450bb27db5ea3abd331760668d88bbbc7ded056ceeala8 100.0% (.VC) VisiCalc spreadsheet (1000/1) 2016-02- 
05 21:35:34 

911ecd4507a44a322225b5b44686e4ac6el3eed060990114162027a37b9d5e29 100.0% (.VC) VisiCalc spreadsheet (1000/1 ) 2016-01- 
14 10:49:56 

blca8760485e933d51feal7185fb7d7c44d7ea8cd35e2695b820e5bd577fd720 100.0% (.FLC) FLIC FLC video (1/1) 2015-09-30 
02:16:34 

5228d40cd6b515c26ee8b6aa43c4650caaal5af747ad7al551d3ce2989aa88f8 100.0% (.INI) Generic INI configuration (1000/1) 2015- 
07-17 17:47:39 


[hide] 


»2cf33af786f3564a9e [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <d25921480234285@web.oniichan.onion> 
Date: Sun Nov 27 08:1 1 :25 201 6 



Download ca3.qpqDownload f28.qpq 
»9ae3141e5e 


[hide] 


»d1f7f8e7bb0afad3f4 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <6747f1480234626@web.oniichan.onion> 
Date: Sun Nov 27 08:1 7:06 201 6 


Alright. They need some major improvement anyway. 

http://gatewav.glop.me/ipfs/QmRaJsSCgsw43cBQXSU3ndnuaVw9iNeciq4ixGcfCBdsEu/wltr9.py (MAIN SCRIPT) 

http://gateway.glop.me/ipfs/QmaGtLezTMWCJKiKv6AzfZFs2rHLJrL9KbNHwqopxgnngq/tx.py 

http://gateway.glop.me/ipfs/QmQBYhnAUw7bJPRRoNipzpv7fdHiwk4nOrCbPbcZBNv2vc/blocktx.py 

http://gatewav.glop.me/ipfs/QmWqLTocNgPPVnv3RgRaQa7i7ceqxzX3TDV3PGqfUcs8Y2/blockrtx.py 

http://gateway.glop.me/ipfs/QmZ4UZdg2kXrokUJcTBGMWCKTSYmecBdWkHFAqWNHBtJUA/additx.py 

Right now they require 

1. local copy of the blockchain (rpc server) 

2. linux(/osx?) machine 

3. trid downloaded and placed in a directory called "triddir" 

4. python 3 

and probably other stuff I'm missing 
Usage: 

./tx.py [txid] [directory] 

./blocktx [block height] [directory] 

./blockrtx [block height 1] [block height 2] [directory] (All blocks between height 1 and height 2) 

./addrtx [address] [directory] 

Each one creates 3 files in [directory]: 
resfile: Trid output for all transactions without "Unknown!" 
asciifile: Fragments of decoded ascii in output scripts 
txfile: txids for each result in resfile 

as said below, my scripts handle the 8 bytes thing (i think) 


[hide] 


»9f824d35be8ac2df0b [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <a840c1480240635@web.oniichan.onion> 
Date: Sun Nov 27 09:57:15 201 6 


Download insterter.py 

>1 took Satoshi's bitcoin inster code and tried to comment out enough parts to get it to spit out how it would encode a file into BTC 
transactions. 

>You can see it here: 

>http://gate way. glop. me/ipfs/QmejJjc35y7FEGguNTTE3ZeXhpeCklxhAWsA2fS5wYpxHw/insterter.py 



>You can run it like this: 

>python ftle.zip 1 HB 5XMLmzF Vj 8 ALj 6mfB sbifRoD4mi Y 3 6 v 10 .1 
>Hope this can help someone make progress reverse engineering this stuff. 


[hide] 


»b2ab697cccd58855ac [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <b9cd71480302045@web.oniichan.onion> 
Date: Mon Nov 28 03:00:45 201 6 


https://pr0gramm.com/top/1629324 


[hide] 


»e21 bace768d8d 94033 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <dbaca1480303760@web.oniichan.onion> 
Date: Mon Nov 28 03:29:20 201 6 


Download fees.pngDownload mem. png 


[hide] 


»11d37f14b6bb93cc1a [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <1a3431480306054@web.oniichan.onion> 
Date: Mon Nov 28 04:07:34 201 6 


Is the BM channel not working? 


[hide] 


»f724c2b3c41 b272ef2 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <7cc8d1 480307879@chan> 
Date: Mon Nov 28 04:37:59 201 6 


>https://8ch. net/tech/res/679042. html just got deleted. 
>Anyone have a backup? They are trying to delete everything. 


[hide] 


»9f0da779777ad4e789 [Reply] 
Subject: None 



Name: Anonymous 

MessagelD: <86bba1480308585@web.oniichan.onion> 
Date: Mon Nov 28 04:49:45 201 6 


http://8ch.net/tech/res/679042.html just got deleted. Anyone have a backup? 


[hide] 


»28e1e51d7126ccdec1 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <5c4c41480308765@web.oniichan.onion> 
Date: Mon Nov 28 04:52:45 201 6 


>You may not know what the SDN list (Specially Designated Nationals) is but we ll explain. It’s the US version of Iran and Chinas 
state censorship machine. Initially created with good intent to inform the world (and US entities, persons) of Terrorists, Rogue regimes 
and other wrongdoers. It slowly converted into a censorship list to block free speech on the Internet. You see, by adding a website to 
the list the U.S authorities could then evoke a closure order on the registrar where the domain is registered. Of course, if it’s a .com or 
.org then the US can evoke the said closure order anywhere in the world via ICANN. 

>In 2006 the US censored a series of Cuba websites. Some with benign propaganda about the deceased American writer Ernest 
Hemingway www.Cuba-Hemingway.com while others preyed into the apparently dark and mysterious www.CubanCulture.com . The 
latter may have been added to the list because of the brief article on the locally active black magic and covert babalawos? 

>Shutting down the websites then became easy work. A quick call from a Government office to the US based Enom and ICANN and 
the sites were “disappeared” from worldwide viewing. Gone... Two years and counting 

http://www.thecubablog.com/uncategorized/staff/the-us-has-a-way-to-shut-down-wikileaks-the-infamous-sdn-list/ 


[hide] 


»523e4b0fb29bd1a063 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <658f51 48031 1390@web.oniichan.onion> 
Date: Mon Nov 28 05:36:30 201 6 


Download disk.jpg 
»9f0da77977 

8ch.net is now completely down. Please save all threads if possible and post them here. 


[hide] 


»8f1 383c36f2421 da6e [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <99820148031 1560@web.oniichan.onion> 
Date: Mon Nov 28 05:39:20 201 6 


I actually am decoding them slightly differently. Scripts floating around remove the first 8 bytes as per the satoshi downloaded i don't 
remove them unless they are a valid checksum for the rest of the data. 

file headers: http://gateway. glop.me/ipfs/QmbnbcW2 1 gmHsYH9m2NTKLWphGZB5H6wxYZ8rFtKiu8Cxf/resfile 
ascii: http://gatewav.glop.me/ipfs/QmafoqorvVJNTtyNDSnkQHrcQa3vqYvPdv6iFiTSPFMaLl/asciifile 



Also found 

574324e77312679f42da66171933fc958eaf05286fb5c8702e4bf679al24f90a 
100.0% (.P7S) PKCS #7 Signature (1001/2) 

Tue Nov 10 00:00:00 2015 
from block 383019 

8e5e6e5e2344983ba4a919113el949ef993406f9e778c310ba9ce0d5edb8f50b 
100.0% (.P7S) PKCS #7 Signature (1001/2) 

Wed Nov 11 00:00:00 2015 
from block 383092 

Most likely coincidences though, after examining the transactions. 


[hide] 


»a1 c3503f3ed670d475 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <28188148031 1743@web.oniichan.onion> 
Date: Mon Nov 28 05:42:23 201 6 


http://gatewav.glop.me/ipfs/QmS3zs98mFmvqGdxRaUCrx3e42UsLXQ6VfRpSXrKrk8SAZ/276.gpg 
http://gatewav.glop.me/ipfs/OmShOicUaKagC6hXzXqCdtRvP8pAXfBkiP5C51XsZVZg2e/737.gpg 
http://gatewav.glop.me/ipfs/QmZxXabEusrSK4e9esLGJY7YAqLxxXhXPCvXhNWcnEVQH9/cce.gpg 
http:// gateway. glop.me/ipfs/Qmcn V ecuQtob Y WUkhUHGFLV AzfokQRRY s WKS2j V8bJwsic/d3c. gpg 
http:// gateway. glop.me/ipfs/Qmao 1 2d6tWh 1 5b A5mU YQ 1 pcoT aiMc yb85SNyzrsS25 wpFa/eb7 . gpg 

>GPG keyrings: 

>7b42129c959b7db85688c5c686cl7eabdal0156138d96fb738fb8f0513dl34af 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1) 2016-11-11 17:29:06 

>2593dbef02eeb4c7528773b0bdf0a4aba35ae347 1 b 1 07dee49886f8fe894f 1 fO 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1) 2016-10-31 19:41:29 

>17a65dac7d411e6151631025c3b9ab22cf87d6dd4cad67a097903152dab4ab93 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1) 2016-10-11 20:28:11 

> 1 5dde0ff8e9e2 1 3ed20acdb0 1 e3c58faad749 1 c6f3a93cdc54dba055b45b737 1 100.0% (.GPG) GNU Privacy Guard public keyring 
(1000/1) 2016-07-27 13:21:06 


[hide] 


»494cbb698ea3749254 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <af1b1 1480313746@web.oniichan.onion> 
Date: Mon Nov 28 06:15:46 2016 


Download end.zipDownload tech.zipDownload heads. zipDownload nov9.zip 


[hide] 


»0cdd539ebe75d7a72c [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <791 cdl 48031 7370@web.oniichan.onion> 
Date: Mon Nov 28 07:16:10 2016 



»28ele51d71 

Interesting. So this only seals the cemented idea that IP & DNS are a no-no (IANA&ICANN). I'd even go as far to say globalized 
domains are bad. Thanks Cubanos. 

»523e4b0fb2 

Thread backup, archive if you must. 


[hide] 


»ff3e7058e68eb8f933 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <588301 480345546@web.oniichan.onion> 
Date: Mon Nov 28 1 5:05:46 201 6 


>>88831 aea8 

Trips confirm. 


[hide] 


»003680dabd4bccefc0 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <6c5571480345667@web.oniichan.onion> 
Date: Mon Nov 28 1 5:07:47 201 6 


>>88831 aea87 
Trips confirm! 


[hide] 


»73f68b582d598d4d5e [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <1 7b271 48034741 2@2hu.tld> 
Date: Mon Nov 28 15:36:52 2016 


»a62a9230ff4c 15005b 
what does this prove? 


[hide] 


»ff99070ed1 4c206f85 [Replvl 
Subject: None 
Name: Shasta 

MessagelD: <c34521480356357@2hu.tld> 
Date: Mon Nov 28 1 8:05:57 201 6 


438498967600 -> I'm back on Tox when you get a chance to log back in. I got questions about the new code - jean3, jean3_8bit and 
those pgp keys found up thread. 



[hide] 


»ceb5303ef297663d2e [Repivl 
Subject: None 
Name: Anonymous 

MessagelD: <ecf861 480372831 @chan> 
Date: Mon Nov 28 22:40:31 201 6 


Some things I noticed this afternoon: 

endchan now has IDs 

I'm blocked on endchan 

Bitmessage deleted all my identities 

My phone was disconnected 

Beamstat seems to not be updating properly 


[hide] 


»34c9f05091e92bec83 rReolvl 
Subject: None 
Name: Anonymous 

MessagelD: <e1e361480374633@web.oniichan.onion> 
Date: Mon Nov 28 23:10:33 2016 


>endchan now has IDs 

Only on /pol/. Other boards don't. Ask the board owner, iirc, odilintime was working on something, why the site is being updated as 
we speak. Contact him on irc.rizon.net/#endchan if you need prove. 

>I'm blocked on endchan 
above. 

>Bitmessage deleted all my identities 

Which node? Also, IIRC, you can self-delete them. 

>My phone was disconnected 
Why do you even have a phone? 

>Beamstat seems to not be updating properly 
can't say shit about it. 


[hide] 


»91 502ac378dea7f1 67 [Repivl 
Subject: None 
Name: Anonymous 

MessagelD: <b5541 1480376325@web.oniichan.onion> 
Date: Mon Nov 28 23:38:45 201 6 


Made account using lOminute mail, with a temporary user and password. Now only SnakeDude (pays the bills), OdiliTime 
(dev/sysadmin), Balrog, and global volunteers should have any access. YW. 


s6424n4x4bsmqs27.onion/POLAK/catalog.html 


[hide] 


»355ea9047367f4e0d0 [Replvl 
Subject: hi /pol/ 

Name: Anonymous 



MessagelD: <1b6ae1480377375@web.oniichan.onion> 
Date: Mon Nov 28 23:56:1 5 201 6 


[insert text] 


[hide] 


»327f271355d91 46844 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <ff9931480382259@web.oniichan.onion> 
Date: Tue Nov 29 01 :1 7:39 201 6 


Was dissapointed in the antics of those that raided endchan. Spamming until they bloked torposting.I appreciate the backup here. 


[hide] 


»4e1 af87580f256efa5 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <a49c71480382492@web.oniichan.onion> 
Date: Tue Nov 29 01 :21 :32 201 6 


»34c9f05091 

»91502ac378 

»327f271355 

Logless BM bunker 

http://gateway.glop.me/ipfs/QmSLGxufdzkNBMGqglNwUuaCrcethPavN3iPzNYFtSDEkK/ffbbd7d918a09e876a06820498ec9e0c.ip 

g 

Use the text in this image, generate its SHA256 hash value. 

Add Chan -> Create a new chan -> chan name: [hash] 


[hide] 


»91 27c42278e047fadc [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <c58c91 4803961 08@web.oniichan.onion> 
Date: Tue Nov 29 05:08:28 201 6 


»5257babec8 

>anonlobo 

this guy is not responding 


[hide] 


»c71 8bad81 47621 2822 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <293281 4803971 87@chan> 
Date: Tue Nov 29 05:26:27 201 6 



»ff99070edl 
You're not answering. 


[hide] 


»8c2f4c7e35b3e7c9ed [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <bea091480402670@web.oniichan.onion> 
Date: Tue Nov 29 06:57:50 201 6 


»9127c42278 

»c718bad814 

This is why I don’t depend on anybody for leaks. 


[hide] 


»3c609880801 OedOdeO [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <f384d1 4804051 1 1 @web.oniichan.onion> 
Date: Tue Nov 29 07:38:31 201 6 


»8c2f4c7e35 

this is why the keys are not out 


[hide] 


»07fe5e24f5ca5a1 224 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <dbf4a1 480406789@web.oniichan.onion> 
Date: Tue Nov 29 08:06:29 201 6 


»3c60988080 

Let's get a real bunker going for fucks sake 


[hide] 


»f3bba66f54e1f0b000 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <2c88d1480408606@chan> 
Date: Tue Nov 29 08:36:46 201 6 


»e5b3b010e0 

http://gatewav.glop.me/ipfs/QmSYglTfsV7vKW3hzQRy9qxMSDUgztka5vVu91S9sFVeuM/code-fixed.7z 


[hide] 


»1da98069049c2d71c4 [Reply] 


Subject: None 
Name: Anonymous 

MessagelD: <9050e1 48040961 9@chan> 
Date: Tue Nov 29 08:53:39 201 6 


»07fe5e24f5 

Just set one up. If you want the link let me know so we can figure out a way to pass it on. 


[hide] 


»3b59b1 acbl 1 ac24e4a [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <e2e871 48041 0659@web.oniichan.onion> 
Date: Tue Nov 29 09:1 0:59 201 6 


»327f271355 

SOOOO, went back for fun on those 2 threads, and the posts were deleted by: 

>Anonymous Board volunteer 11/29/2016 (Tue) 08:24:49 Id: 0de6c2 [Preview] No. 23993 del 
Ask Odilitime to confirm. At this point, I fucking don't care. 


[hide] 


»df26eb93b19d025640 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <71 5831 48041 0869@web.oniichan.onion> 
Date: Tue Nov 29 09:1 4:29 201 6 


Evidence can even be seen left over by the link that did exist as a reply: 
s6424n4x4bsmqs27. onion/pol/res/22737. html#239 10 


[hide] 


»8c2a3d37b709f0c02e [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <c91c61 48041 2487@web.oniichan.onion> 
Date: Tue Nov 29 09:41 :27 201 6 


Download BMisaettinqbombedhard.pnq 
»9127c42278e047fadc 

>When i said monday I meant last monday and someone did come by other than anonlobo. 

I really have no idea wtf anonlobo is doing he was talking quite frequently before Sunday. 

You know the logless BM bunker ill send a message saying Prum in it so you can PM me about this because my router can't handle 
idling on i2p. (going to post an image here for you to crack in the mean time (just incase I never get to BM) fucking bitmessage isn't 
making any connections for me today) 

But really setup dark hype peers we are pushing for this later because it doesn't require the real internet. 


[hide] 



»f01 75b73a2d836cfe0 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <2089d1 48041 3299@web.oniichan.onion> 
Date: Tue Nov 29 09:54:59 201 6 


Download BMisqettinqbombedhard.pnq 
»9127c42278e047fadc 

>When i said monday I meant last monday and someone did come by other than anonlobo. 

I really have no idea wtf anonlobo is doing he was talking quite frequently before Sunday. 

You know the logless BM bunker ill send a message saying Prum in it so you can PM me about this because my router can't handle 
idling on i2p. (going to post an image here for you to crack in the mean time (just incase I never get to BM) fucking bitmessage isn't 
making any connections for me today) 

But really setup dark hype peers we are pushing for this later because it doesn't require the real internet. 

>If a bunch of double posts come in it's because psi is lazy 


[hide] 


»3800083c23d94d86c5 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <4e0ae1480422283@chan> 
Date: Tue Nov 29 1 2:24:43 201 6 


why do i see the same reply twice 

»f0175b73a2d836cfe0 

»8c2a3d37b709f0c02e 


[hide] 


»d4f781e92431d32871 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <acd0a1480424238@web.oniichan.onion> 
Date: Tue Nov 29 1 2:57:1 8 201 6 


»3800083c23d94d86c5 

>"If a bunch of double posts come in it's because psi is lazy" 
Good question now go ask psi to fix it. 

Also did you get my PMs on BM yet? 


[hide] 


»4fec9e4744b15a9051 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <f062e1 480426957@2hu.tld> 
Date: Tue Nov 29 1 3:42:37 201 6 



»3800083c23 
they posted twice 


[hide] 


>>985471 2afd70408b7b [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <a841f1480434232@chan> 
Date: Tue Nov 29 1 5:43:52 201 6 


»d4f781e924 
Yeah. Thanks. 


[hide] 


»6369e43c3325e173c6 [Reply] 

Subject: None 
Name: shasta 

MessagelD: <c1 7e61 480436743@2hu.tld> 
Date: Tue Nov 29 1 6:25:43 201 6 


»c718bad814 

Sorry I was away a lot longer than I thought I would have been yesterday. I'm on but doing IRL work. I'll be on until about lam UTC 


[hide] 


»b67db96922391 a42ab [Reolvl 
Subject: None 
Name: shasta 

MessagelD: <3b45f1480448998@2hu.tld> 
Date: Tue Nov 29 1 9:49:58 201 6 


»e5b3b010e0 

ok. I've got the DB starting to parse the block info. It looks like it'll need to run at least a few hours - maybe all night. 

>Once it's done do we want to host the out.db file somewhere? 

>IPFS? 

>and How to get it there? 

I'm not currently running IPFS anywhere. It will be big if run against the entire block chain; which is what I'm doing. 

>Next - what to look for within the DB relationship wise? 

>Do we want to host a simple site to go through the info? 

>Start running the wallet. py or tird script against the DB? 


[hide] 


»c25c039d8a81 ae9764 [Reply] 
Subject: None 
Name: Anonymous 



MessagelD: <b5e621480467424@chan> 
Date: Wed Nov 30 00:57:04 201 6 


Can you scan these addresses: 

lKEyVEndor3p6c3NL2UiVhscXPZKb3DfYl 

lKEYVENdoRGdbgzXUW8eJVzNp5yoTGG7hg 

3CaaFJF39T9TWiNtCKTnU79A3NvGeWKdqL 

lNquFlc4AuKx9YJtP9SsjGqhazfa72yPBM 


[hide] 


»7557e708baaf381 1 84 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <f963d1 480468367@chan> 
Date: Wed Nov 30 01 :1 2:47 201 6 


»e5b3b010e0 

http://gatewav.glop.me/ipfs/QmVhnQaWprlE99S6R7ZYsRsK9TB5biPigoR21Q4Bg5rwzG/db-fixed-for-the-last-fucking-time.7z 


[hide] 


»52d0d1 55ff70b84576 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <ae9fd1 480480581 @ucavviu7wl6azuw7.onion> 
Date: Wed Nov 30 04:36:21 2016 


Please note that only UNSPENT transactions will contain data. 

If a transaction is SPENT, it means that someone managed to generate a Private Key corresponding to an address that is a 
representation of that block of data (THIS BORDERS ON IMPOSSIBLE). 

Jean's script, last I checked, does not do this. 

MODIFY THE SCRIPT TO ONLY INCLUDE UNSPENT TRANSACTIONS. 


[hide] 


»7770f3c474871cbf7b [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <8f7871480529594@chan> 
Date: Wed Nov 30 1 8:1 3:1 4 201 6 


»8c2a3d37b7 

BM is kill. Where else can we talk? 


[hide] 


»4667e5d76a63f50547 [Reply] 


Subject: None 
Name: Shasta 

MessagelD: <c041d1 48053791 9@2hu.tld> 
Date: Wed Nov 30 20:31 :59 201 6 


can someone take a look at DROID 

>http://www. national archives, gov.uk/information-management/manage -information/preserving -digital-records/droid/ 

and see if it would be easy to modify the wallet code to use this instead of TrID? DROID was developed by the National Archives to 
id digital file types and uses the PRONOM technical registry for sig definitions. 

I personally am just being lazy in not rolling up a Linux VM to run the TrID x86 version. 


[hide] 


»b6281 01 364dcb9b1 2d [Repivl 
Subject: None 
Name: Anonymous 

MessagelD: <dff281 480538531 @web.oniichan.onion> 
Date: Wed Nov 30 20:42:1 1 201 6 


»4667e5d76a 
>. gov.co.uk 

I wouldn't even open that in tor browser. 


[hide] 


»abc8795b1 5cb87a594 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <451 3b1 48053991 4@chan> 
Date: Wed Nov 30 21 :05:1 4 201 6 


»52d0dl551T 
like this? 

lazy version of this 

http://gatewav.glop.me/ipfs/Oma47U9fvVT2DzV2qRSVMXtt78rEBfEA1191MSwKdDzFBG/newiean3.py 


[hide] 


»fc1ca202725fccc08f [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <62bed1480550786@2hu.tld> 
Date: Thu Dec 1 00:06:26 2016 


Download 1 HB5XMLmzFVi8AU6mfBsbifRoD4miY36vnew tx list.txt 

>>24216 

interesting after running newjean3 for an hour or more on the WL wallet I got this: 

Traceback (most recent call last): 

File "newjean3.py", line 95, in <module> 
decoded_data = txdecode(str(lll)) 



File "newjean3.py", line 36, in txdecode 

data = urllib2.urlopen(" https://blockchain.info/tx/"+transaction+"?show adv=true" ;) 

File "/Library/Frameworks/Python. framework/Versions/2. 7/lib/python2.7/urllib2.py", line 126, inurlopen 
return _opener.open(url, data, timeout) 

File "/Library/Frameworks/Python. framework/Versions/2. 7/lib/python2.7/urllib2.py", line 406, in open 
response = meth(req, response) 

File "/Library/Frameworks/Python. framework/Versions/2. 7/lib/python2.7/urllib2.py", line 519, in http_response 
'http', request, response, code, msg, hdrs) 

File "/Library/Frameworks/Python. framework/Versions/2. 7/lib/python2.7/urllib2.py", line 444, in error 
return self._call_chain(*args) 

File "/Library/Frameworks/Python. framework/Versions/2. 7/lib/python2.7/urllib2.py", line 378, in _call_chain 
result = func(*args) 

File "/Library/Frameworks/Python. framework/Versions/2. 7/lib/python2.7/urllib2.py", line 527, in http_error_default 
raise HTTPError(req.get_full_url(), code, msg, hdrs, fp) 
urllib2 . HTTPError: HTTP Error 502: Bad Gateway 

I know it's not my ISP because I was streaming news at the same time this 502 error hit. 

attached is the TX list file. The last TX processed is from July, 2015. So all the TX in the list are "unspent" TX from WL and most 
likely have data - Am I correct? 


[hide] 


»5fbfc71474a447e43e [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <54d71 1 480551 1 36@web.oniichan.onion> 
Date: Thu Dec 1 00:1 2:1 6 201 6 


»fclca20272 

>macos 

there's your problem 


[hide] 


»7e1e5fe2f29eed6875 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <b2b971 480551 504@web.oniichan.onion> 
Date: Thu Dec 1 00:1 8:24 201 6 


Does this page look like it was censored? 

https://blockchain.info/block/000000000000000001f4840a9cc93cb949697f97969el984f69f789385d00cd7 


[hide] 


»202732f97f3d670365 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <06b031480557457@web.oniichan.onion> 
Date: Thu Dec 1 01 :57:37 201 6 


Download zeroed. png 

»7ele5fe2f2 



[hide] 


»9d6b0c1 379d61 70df0 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <0b4ac1480560268@chan> 
Date: Thu Dec 1 02:44:28 2016 


Download theyrehere.jpg 

»7ele5fe2f2 

»202732f97f 

>>24222 

>>24230 

It's real. They flat out deleted a block. 

https://blockchain.info/rawblock/000000000000000001f4840a9cc93cb949697f97969el984f69f789385d00cd7 


{ 

M hash":"000000000000000001f4840a9cc93cb949697f97969el984f69f789385d00cd7", 

"ver":536870912, 

"prev_block" : "000000000000000002670ad664a90b86 1 7c 1 5e9902f3600 1 6bf334d6ec9e 1 c9f ' , 
"mrkl_root":"001baa524eceblb2561adlb9acflf62d39671e52a6e217965798893f8cf70014", 

"time" : 1480549 1 74, 

"bits":402908884, 

"fee":0, 

"nonce":3679241 102, 

"n_tx":l, 

"size":238, 

"blockjndex": 1171372, 

"main_chain":true, 

"height":441339, 

"received_time" : 1480549 1 74, 

"relay ed_by" :"178.62.203.185", 

"tx":[ 

{ 

"lock_time":0, 

"ver":l, 

"size": 157, 

"inputs" :[ 

{ 

"sequence":4294967295, 

"Script":"03fbbb060436633f582f4254432e434f4d2ffabe6d6de98fc4fc3e8afe90f534c7af4231c22662c91 1 1753ff7b433703142fl 17720 
620 1 0000000000000002b6789c447 aOOOOOOOOOOOO" 

} 

], 

"time": 1480549174, 

"tx_index" : 194265303, 

"vin_sz":l, 

"hash" :"001baa524eceblb256 Iadlb9acflf62d39671e52a6e217965798893f8cf7 0014", 

"vout_sz":l, 

"relay ed_by" :"178.62.203.185", 

"out":[ 

{ 



"spent":false, 

"txjndex": 194265303, 

"type":0, 

"addr" : "3NA8hsjfdg VkmmVS9moHmkZs VCoLxUkvvv" , 
"value": 1250000000, 

"n":0, 

"Script":"a914e083685al097celea9e91987ab9e94eae33d8al387" 

} 

] 

}] 

} 


[hide] 


»cb3bb7c770f61 Ofl 8f [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <c805b1 48061 3304@chan> 
Date: Thu Dec 1 17:28:24 2016 


Download loveint.png 

https://twitter.com/Snowden/status/803640548464594944 
>Edward Snowden Verified account 
>@ Snowden 

>Edward Snowden Retweeted NYT Metro Desk 

>Remember "LOVEINT" — the illegal @NSAGov practice of spying on people you like? Turns >out prosecutors have been doing the 
same thing. 

>8:43 AM -29 Nov 2016 

https://twitter.com/NYTMetro/status/8034525530108Q2689 

>NYT Metro Desk Verified account 

>@NYTMetro 

>Brooklyn prosecutor is accused of using illegal wiretap to spy on love interest 
>8:16 PM -28 Nov 2016 

>And this is where the DoJ right now is demanding the FBI to stop it's investigation, thus you understand the friction. 

>Note that most SVU agents _are_ former convicts. The questions that everyone should be asking: are these former pedophiles using 
their positions to continue their escapades? 

>Could they _abuse_ their current positions with all the new tools the NSA granted them? 

>If you are a historian, you should know the answer. And a quick investigation on LOVEINT will dossies everything. 

>Sun Nov 6 11:19:29 2016 

[spoiler] Remember Assange's latest ’charges'[/spoiler] 


[hide] 


»aeba2369d2b01 30443 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <88bc21 4806221 18@chan> 
Date: Thu Dec 1 19:55:18 2016 



jean3.py + ASCII text detection 

http://gateway.glop.me/ipfs/Qmeiv5XxrcZTanNuLlUCegJMZZfzsVh4fF4x2YGQBUKbY3/iean3.py 

Patched newjean3.py (only reads data from unspent addresses) 

It also detects ASCII text now. 

http://gateway.glop.me/ipfs/OmXHcwhPK2nLKrBsdhFsZWQE6RFXTgr7iY9oo7QLR4TXU3/newiean3.py 


[hide] 


»af1 edd0ff060451 7be [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <5951 91 480641 01 8@chan> 
Date: Fri Dec 2 01:10:18 2016 


>Is page 8 about m_cetera? 

https://wikileaks.org/IMG/pdf/Assange-WikiLeaks-Enemy-USAF-FOI.pdf 


[hide] 


»07266cfa9e1 35a2f38 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <1 74281 480642594@chan> 
Date: Fri Dec 2 01 :36:34 201 6 


Download subkevs.txt 
file header dump 


[hide] 


»bd6996fbbbd067cda9 [Reply! 

Subject: None 
Name: shasta 

MessagelD: <ce53d1480693083@2hu.tld> 
Date: Fri Dec 2 15:38:03 2016 


»07266cfa9e 

I can't find/see these characters in the script that cause this error. 

>File "blockscan.py", line 13 

>SyntaxError: Non-ASCII character 'Vxe2' in file blockscan.py on line 13, but no encoding declared 
Adding a '#coding = < >' doesn't fix the error either. 

Is there a way you can push this code to a pastebin? 

Also <438498967600> not sure if you changed Tox ID, but haven't seen you in 2 days... My Tox/Tor have been acting up yesterday 
and today so that might be the issue. Need some help with the codes if we can hook up. 


[hide] 



»4aed5b4dd0a672a9b8 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <507a71480705008@2hu.tld> 
Date: Fri Dec 2 18:56:48 2016 


Download block383001 -3831 OO-pgps.txtDownload blocks383001 -3831 OO-secret.txtDownload blocks383001 -3831 00- 
sub.txt 

blocks 383001-383100: 

any line that has pgp in it (97 total) and broken out in secret and sub 


[hide] 


»7827624f00a45ac743 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <4e8c01480705342@2hu.tld> 
Date: Fri Dec 2 19:02:22 2016 


Download 1 HB5XMLmzFVi8AU6mfBsbifRoD4miY36vnew file tx list.txt 
all the unspent TX from WL wallet for 2016 

3 - GPG keyrings: 

10-12-16 - TX = 82671d766bf76e3779ffd42493c71979bb8caefl5f2a9642dcb0b7389ac0027d 

10- 31-16 - TX = 8dalfblb0e9fb4d01e0a8cbe35781e79fe6bcc0c071cc9d7aa6a9a595e44e43e 

11- 11-16 - TX = 7b42129c959b7db85688c5c686cl7eabdal0156138d96fb738fb8f0513dl34af 


[hide] 


»a2c3d962668682531 7 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <df2dc1 48071 8395@2hu.tld> 
Date: Fri Dec 2 22:39:55 201 6 


Download m cetera2.jpg 

»8c52ab606f 

what are your proofs that @m_cetera contrails @wikileaks twitter accounts? 
So far I found no proof of that anywhere: 

@ fIN AL_C0UNTD0 WN https://twitter.com/fINAL COUNTDOWN 
claims that 

@m_cetera https://twitter.com/rn cetera 
runs @wikileaks twitter account 



So far he didnt provide any proof (timing and tantrum doesnt cont much), his last tweets mentions some session cookies IDs, for 
which I am pretty sure he doesnt have access too. Even if he somehow saw m-ceteras or wikileaks cookies, how can he know twitter 
session cookie ids for certain users? 


[hide] 


»dde4a81 5f238ad6bfe [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <24a241 48071 9621 @2hu.tld> 
Date: Fri Dec 2 23:00:21 2016 


Download mceteral .jpg 

»a2c3d96266 
I forgot first pic. 

https://twitter.com/fINAL COUNTDQWN/status/80444825 1235569664 

>the second one, if you missed it, was the session ID. You know, the cookie you use to keep you logged into Twitter. 

It think that by "the second one"' he refers to some tweet, but he didnt link anything 

Even if he somehow saw @m_cetera session cookies, you cant just get users ID from them. I havent looked deep into twitter cookies 
but I assume cookie id or value isnt just base64 of username. I think @fINAL_C0UNTD0WN just throw our some technical jargon 
thinking that readers have no idea how cookies work. 

Did anyone saw that alleged second tweet? 

Did anyone saw any other reasons why one would think she runs @wikileaks? 


[hide] 


»7a2e42eaf6a458ce9f [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <ce5671480720847@web.oniichan.onion> 
Date: Fri Dec 2 23:20:47 201 6 


»4aed5b4dd0 

»7827624f00 

You should try to extract the valid packets from those pgp files. 
http://superuser.com/questions/801526/how-can-i-fix-a-corrupted-pgp-file 


[hide] 


»932457d7f431d3cca1 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <6739a1480721 141@chan> 
Date: Fri Dec 2 23:25:41 2016 


»bd6996fbbb 



dont use tox 


[hide] 


»497f007f2b2bb1 695a [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <aba661480725022@chan> 
Date: Sat Dec 3 00:30:22 201 6 


Download packets, py 

»7a2e42eaf6 

»7827624f00 

»4aed5b4dd0 

»07266cfa9e 

Script to print all valid packets in a gpg file: 

http://gatewav.glop.me/ipfs/QmYLb88V3v9Bql5E6eX72XEwuTpqF7JEU3DboGFPvSdUtz/packets.py 

Usage: 

python packets. py 

(prints all valid packets in all gpg files in that directory) 


[hide] 


»676c0028c04a762e30 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <8c3361480725688@chan> 
Date: Sat Dec 3 00:41 :28 201 6 


»497f007f2b 
then do 
»7a2e42eaf6 


[hide] 


»0a5ab1 1 b23efe8efd6 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <e83a31480890474@web.oniichan.onion> 
Date: Sun Dec 4 22:27:54 201 6 


Has anyone tried searching for the Wikileaks public keys in the blockchain? 
https://wikileaks.Org/index.en.html#submit wlkey 
http://pgp.mit.edu/pks/lookup?search=Qxl 1015F80&op=index 
https://sks-kevservers.net/pks/lookup?op=vindex&search=wikileaks&fingerprint=on 


[hide] 


»a286d61 6ac2b525a41 [Replvl 


Subject: None 
Name: Anonymous 

MessagelD: <876291 480893743@web.oniichan.onion> 
Date: Sun Dec 4 23:22:23 201 6 


Download packets.txt 

>Dumping the output of 'gpg -list-packets' for all that don't return with no 'valid OpenPGP data found' 
>There's a couple of 'gpg: onepass_sig with unknown version’ 

>Might be a good idea to also run 'gpg — with-fingerprint' 

>http://gateway.glop.me/ipfs/QmaRiuxiadz6uE8q9tvxuJ7jLUDYiBJ4fVWcCMHHYMr7Qs/packets.txt 

>Has anyone tried searching for the Wikileaks public keys in the blockchain? 
>https://wikileaks.org/index.en.html#submit_wlkey 
>http://pgp.mit.edu/pks/lookup?search=Oxl 1015F80&op=index 
>https://sks-keyservers.net/pks/lookup?op=vindex&search=wikileaks&fingerprint=on 


[hide] 


»d5b1 e0707683beb42e [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <ccc6e1480909623@chan> 
Date: Mon Dec 5 03:47:03 2016 


>sql 

http://dumps.webbtc.com/bitcoin/ 


[hide] 


»ac0ba96e99d18448d0 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <9b02d1480958959@web.oniichan.onion> 
Date: Mon Dec 5 17:29:19 2016 


»bd6996fbbb 
you're never online 


[hide] 


»0281 1c9b20407ddafe [Replvl 
Subject: None 
Name: shasta 

MessagelD: <af4601480967797@2hu.tld> 
Date: Mon Dec 5 1 9:56:37 201 6 


»ac0ba96e99 

sent you a message at that ID from my new ID 

BDF829A0754752F9249CAAF7752604A386D9FFC1091341285EB83C60DD5497043DC7563C3E58 


[hide] 



»7ab25acda723ed97ac [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <285271 480974667@chan> 
Date: Mon Dec 5 21 :51 :07 201 6 


https://blockchain.info/tx/3dfd6b96e0583al7b34dcd3a4dcb021949ece3140b7al918c4de07cea32d43647show adv=true 

> 1 HB 5XMLmzF Vj 8 ALj 6mfB sbifRoD4mi Y36v (WikiLeaks ) (0.00008224 BTC - Output) 

> 1 HB 5XMLmzF Vj 8 ALj 6mfB sbifRoD4mi Y36 v (WikiLeaks ) (0.000006 BTC - Output) 

> 1 HB 5XMLmzF Vj 8 ALj 6mfB sbifRoD4mi Y 3 6v (WikiLeaks ) (0.085483 BTC - Output) 
>lHB5XMLmzFVj8ALj6mfBsbifRoD4miY36v (WikiLeaks ) (4.911 BTC - Output) 

> 1 HB5XMLmzFVj 8 ALj6mfBsbifRoD4mi Y36v (WikiLeaks ) (0.0050644 BTC - Output) 

>199111 8e2ccb0b8e0dl4c560ce6092c5a4a94c74 

https://blockchain.info/tx/eaa6a30c4145eca619621ea0b644e9e0f953c5465696382e3b4f0ba8917416ce7show adv=true 
>199111 8e2ccb0b8e0dl4c560ce6092c5a4a94c74 

https://blockchain.info/address/13LBgLZ24X55mr8LqKddy9DusJtbal7NCC 
>2016-11-20 21:43:32 

http://www.mgff99.eom/s/1991 1 18e2ccb0b8e0dl4c560ce6092c5a4a94c74 

https://www.sec.gov/Archives/edgar/data/886982/000119312515171272/00Q1193125-15-171272.txt 


[hide] 


»1 a47864d82f2ec578c [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <0386c1480975224@chan> 
Date: Mon Dec 5 22:00:24 2016 


»7ab25acda7 

fc722ce39094500690a4d4676fe475520d6a0af590336b73202010ca260bbd20 
100.0% (.PGC) PGN (Portable Gaming Notation) Compressed format (1000/1) 


[hide] 


»c1 293a82454c3d56d1 [Replvl 
Subject: None 
Name: shasta 

MessagelD: <f4fdf1480983460@2hu.tld> 
Date: Tue Dec 6 00:17:40 2016 


Download fc722ce39094500690a4d4676fe475520d6a0af590336b73202010ca260bbd20.txt 

»la47864d82 

raw data from that TX. 

I think the PGN is a false positive by TrID. 


[hide] 


»eda41d50cf732e7dc1 [Replvl 
Subject: None 
Name: Anonymous 



MessagelD: <152f61 4809881 37@web.oniichan.onion> 
Date: T ue Dec 6 01 :35:37 201 6 


Download weneedvou.jpg 

>==normies pay attention== 

>Stop relying on scripts and crappy software. The steps to find every single file in the blockchain have been posted here numerous 
times >>22945. A lot of you have been staring at the data for over a week now. Here's another attempt at being even more clear: 

>Every single file has a hex file header. You can see a list of some here: http://www.garykessler.net/library/file_sigs.html and here 
http://file -extension. net/seeker/seeker.cgi?ext=&filetype_AND=pgp&filetype_OR=&filetype_NOT=&seek=Seek%21 However, this 
is not the entire list. The lists 'trid' and 'file' use are not complete either. Yet, you don't even need these lists. You can simply look at 
any file of a type you are interested in finding. Yes, any. Open it with a hex editor and look at the file header. If you want to find a zip 
file, just download any zipfile, look at the header with a hex editor and then search for it. The headers are not going to always be at the 
beginning of the file. Scan the entire file for headers and footers. 

>Yes footers. Files also have footers! You can find the ending of a file by looking for its hex footer. Here are some examples: 
http://www.datadoctor.biz/data_recovery_programming_book_chapterl4-page2.html Again, this is not a complete list. If you want to 
see what the footer of a file looks like, open one with a hex editor. 

>JUST TO MAKE SURE WE'RE BEING COMPLETELY CLEAR HERE: 

>If you find 37 7A BC AF 27 1C, you just found the beginning of a 7-zip file. If you find 89 50 4E 47 OD OA 1A OA, you just found 
the beginning of a PNG file. These are just examples. There are a lot more file headers to look out for. 

>If you find 50 4B 05 06 00, you just found the end of a zip file. If you find 25 25 45 4F 46 you just found the end of a pdf file. There 
are more footers and you can make your own list by looking at different files. These are just examples. There are a lot more file 
footers to look out for. 

>Stop looking at only the beginning of decoded data, trid and file both do this (and badly). It can be anywhere in the transaction! 
>Don't rely on software to do this. Simply search for those hex values in the decoded data! 


[hide] 


»5c8a5c778759bcc013 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <06ee81 481 0551 1 1 @web.oniichan.onion> 
Date: Tue Dec 6 20:1 1:51 2016 


Download IMG 1429. PNG. jpeg 

For publishers for example, so that, as an example we are starting to use Bitcoin, Wikileaks, stuffing our, cryptographic keys of stuff 
that we publish, so, "'we prove that we have published stuff at a particular time by stuffing it in Bitcoin, in the blockchain, and then, if 
someone were to come and try to modify the material that we have published, to take a particular part, that would be detectable'". 
-Julian Assange, Nantucket Project, Sept 28 2104 

'"Wikileaks needs to change in order to survive and thrive through the next few months 1 "... If necessary of course, "’if I’m not able to 
continue'" or the Ecuadorian people are unreasonably blamed for Wikileaks’ publications, "'I will have to resign as editor, but our 
publications will continue'". The part of the necessary defense of Wikileaks, we have engaged in a new project to recmit people across 

the world to defend our publication - "'and we'll give details of that as the weeks go by we will issue guidelines about how you can 

promote Wikileaks publications without censorship.'" 

- Julian Assange, Wikileaks 10 Years Press Conference, Oct 4th 2016 


[hide] 



»54b9a5c286c493f733 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <51 f671 481 062582@chan> 
Date: Tue Dec 6 22:16:22 2016 


use wikileaks' own files to get a nice header list 
https://file.wikileaks.org/file/ 

Some headers: 

AVI 52 49 46 46 

Torrent 64 38 3 A 61 6E 6E 6F 75 6E 63 65 

PDF 25 50 44 46 2D 31 2E 

Zip 50 4B 03 04 14 

7zip 37 7 A BC AF 27 1C 

Some footers: 

7zip 00 00 00 17 06 

You can find this in cablegate.7z you can also make a file in your computer and search for this near the end. footers are not always at 
the end of the file, they are usually towards the end. 

Zip 50 4B 05 06 00 
PDF 25 25 45 4F 46 

dont trust any headers/footers you find online, verify them yourself by using a hex editor, you can use hex editors on windows, if you 
want to find PGP/GPG files for example, make a couple of them on different computers and then look at them with a hex editor, you 
will see the headers at the beginning, footers are usually near the end. use 7zip as an example, make a 7zip file on your computer and 
compare it to cablegate.7z, you will find the footer near the end. see what file types wikileaks commonly uses, get the info for them, 
once you have a nice list of these, you will easily find all files of this type on the blockchain. 


[hide] 


»b97464931 fee81 ee8a [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <a8cc41481086263@chan> 
Date: Wed Dec 7 04:51 :03 201 6 


https://en.rn. wikipedia.org/wiki/Rubberhose %28file system%29 

>The project was originally named Rubberhose, as it was designed to be resistant to attacks by people willing to use torture on those 
who knew the encryption keys. This is a reference to the rubber -hose cryptanalysis euphemism. 

>It was written in 1997-2000 by Julian Assange, Suelette Dreyfus, and Ralf Weinmann.[ 


[hide] 


»2a45d375df473f26b9 [Reply! 

Subject: None 
Name: shasta 

MessagelD: <f81 1 21 481 1 28247@2hu.tld> 
Date: Wed Dec 7 16:30:47 2016 


>>20366 thread is dead/locked. I have the entire thread archived locally as pdf and full html. 
Any decision on where to pick this up? Here? Back on end? 


[hide] 



»dc4801 1 98ac1 4973a6 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <69f421 481 130081 @web.oniichan.onion> 
Date: Wed Dec 7 1 7:01 :21 201 6 


did the endchan thread die? https://s6424n4x4bsmqs27.onion.to/pol/res/20366.html seems like it's locked... 


[hide] 


»5586c0ac05cf64df23 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <896601 481 1 34331 @chan> 
Date: Wed Dec 7 1 8:1 2:1 1 2016 


Ask the Board owner. Dunno if there's another mod. 

And tell odilitime to implement board logs, like in vichan. .global says shit about board specific behavior. 


[hide] 


»29452da8e7d9c55be5 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <f42981 481 1 351 41 @chan> 
Date: Wed Dec 7 18:25:41 2016 


»2a45d375df 

We should continue here. Also here »91502ac378 
s6424n4x4bsmqs27.onion/POLAK/catalog.html 
Working on gajim+PGP+OTR for fastposting 


[hide] 


»60bdba1f7529fde174 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <444a01 481 1361 08@ucavviu7wl6azuw7.onion> 
Date: Wed Dec 7 1 8:41 :48 201 6 


»29452da8e7 

since I work, have to eat, and run, use jitsi 

IMHO, instant messaging is BAAAAAAD opsec. Why I stick to NNTP encrypted servers, or mix Mixminion IV. *Still hope for 
Freenet. 


[hide] 


»0923fd0de1 b80a8bff [Replvl 


Subject: None 
Name: Anonymous 

MessagelD: <0491 fl 481 139894@chan> 
Date: Wed Dec 7 19:44:54 2016 


Download contact.gif 

»60bdbalf75 

»29452da8e7 

»5586c0ac05 

»dc4801 198a 

»2a45d375df 

NEW ENDCHAN THREAD: 

https://s6424n4x4bsmqs27.onion.to/POLAK/res/15.html 
FAST POSTING: 

Download Gajim https://gaiim.org/ (or any Jabber client that supports OTR and a proxy option 
https://wikipedia.org/wiki/List of XMPP client software ) 

Download OTR plugin https://dev.gaiim.org/gaiim/gaiim-plugins/wikis/OffTheRecordPlugin https ://de v . gaj im. org/gaj im/gai im- 
plugins/tree/master/gotr (Or the plugin needed for your Jabber client) 

Create a GPG key (if using GPG for encryption and not OTR) 

Make account: 

Server: volatile. ch 
Advanced: 

Hostname: vola7ileiax4ueow. onion Port: 5222 

Make a new proxy option with manage to: 127.0.0.1 9050 (socks5) 

Preferences (for volatile account): 

Disable 'Allow client / OS information to be sent' 

Disable 'Allow local system time information to be sent' 

Disable 'Log encrypted chat session’ 

Disable ’Allow my idle time to be sent' 

Edit > Accounts > General (for volatile account): 

Disable ’Synchronize accounts status with global status' 

Disable 'Save conversation logs for all contacts' 


[hide] 


»b8e1 6c7c97f0903488 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <f360d1 481 1 4541 3@web.oniichan.onion> 
Date: Wed Dec 7 21 :1 6:53 201 6 


»0923fd0del 
where on jabber is it? 


[hide] 


»a5808f989feab1 6b66 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <025391481 148093@web.oniichan.onion> 
Date: Wed Dec 7 22:01 :33 201 6 



join chat room "ebin" on muc. volatile. ch for epik operations 


[hide] 


»39690e700241ff46a7 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <ac4a91481 1 67331 @web.oniichan.onion> 
Date: Thu Dec 8 03:22:1 1 201 6 


»a5808f989f 

is it taken down already? won't connect 


[hide] 


»ca68bc2c469eb0927b [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <8e0d81481201275@web.oniichan.onion> 
Date: Thu Dec 8 12:47:55 2016 


»39690e7002 
it's an xmpp muc 


[hide] 


»2cdbe931 ac3de8ee3f [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <1 a8b61 481 222644@chan> 
Date: Thu Dec 8 18:44:04 2016 


Download screen. png 
BLOCK 435250 

Link Anomaly Status Amount Size Time 

https://blockchain.info/tx/64abaf5ffac37f41c5alb8b52deb5a21c7400b2a4elf20433bb3120c6c36ae51 Unable to decode output 
address Unspent 0 288 2016-10-21 13:16:09 

https://blockchain.info/tx/3410d6264a83683ce785289eebdl7f7ccbl4b7b2abcee34ece534cflb75087c9 Unable to decode output 
address Unspent 0 269 2016-10-21 13:16:09 

https://blockchain.info/tx/26a78bfda83f5f6b6bae3957calaca31519436617902ea74220233b868b2a805 Unable to decode output 
address Unspent 0 256 2016-10-21 13:16:09 

https://blockchain.info/tx/6e412ca6112f0f0fl4680d83151033bal8Q35eb4b81387flf9ce38dOc6893af Unable to decode output 
address Unspent 0 242 2016-10-21 13:16:09 

https://blockchain.info/tx/5fbfe2dbc0965ccld74ecc06ale4a776d4303a40c8f716168ab6ad01a87794ea Unable to decode output 
address Unspent 0 242 2016-10-21 13:16:09 

https://blockchain.info/tx/a9dbcd57268b4b6d7eb40e09c5b5970f2c4d897bd3d47f83be658bfbc45580fl Unable to decode 

output address Unspent 0 275 2016-10-21 13:16:09 

https://blockchain.info/tx/17202c7ae9efec4dae73dbl45ea61delfae090fd57d667f318871de45d799bcl Unable to decode output 
address Unspent 0 275 2016-10-21 13:16:09 

https://blockchain.info/tx/0fb02f09d710737cdd4c0d47c50774a7allae548b972f071965935955al315b4 Unable to decode 

output address Unspent 0 648 2016-10-21 13:16:09 

https://blockchain.info/tx/944de0e90a70ca65640007d4b5de7619dd0874ad9a8cl709f500c54310ba2e7 Unable to decode 

output address Unspent 0 264 2016-10-21 13:16:09 



https://blockchain.info/tx/0c8e715dbla79a8020e8f292c08f20749dfb8b59e5048884f82c22ac3293a9a6 Unable to decode output 
address Unspent 0 265 2016-10-21 13:16:09 

https://blockchain.info/tx/l Id40e3c6el Ide924be7ec71af2d76cbdddd7a6359a6ea672787aca4ce25c5fb Unable to decode output 
address Unspent 0 237 2016-10-21 13:16:09 

https://blockchain.info/tx/2cd710205c0249eea43d0e589a6beabc9a9d488fc0c9c8e2497b48dfbf9e091 1 Unable to decode output 
address Unspent 0 237 2016-10-21 13:16:09 

https://blockchain.info/tx/82e7dafl9b24d4O228dl4a88add9f7b401951d82181ed532f739cf3clfa2022 Unable to decode output 
address Unspent 0 237 2016-10-21 13:16:09 

https://blockchain.info/tx/aa23347580cc98b47bd662ae418de250141f22b8649dcb79630e56bfc80ea445 Unable to decode 

output address Unspent 0 238 2016-10-21 13:16:09 

https://blockchain.info/tx/d295f447d25a3c8969el 10c9c6a34d92ad86eafa8083ee5dcd449acb369d287c Unable to decode output 
address Unspent 0 239 2016-10-21 13:16:09 

https://blockchain.info/tx/6ecf2b6d21312584c51550534729589cl95a4fe5970688384b3ea76477fd9afe Unable to decode output 
address Unspent 0 297 2016-10-21 13:16:09 

https://blockchain.info/tx/a071 Iaad3475b773f408779aa5aecc523e2c213cecb0f7a93d7d46fflcl36e 18 Unable to decode output 
address Unspent 0 296 2016-10-21 13:16:09 

https://blockchain.info/tx/59d41ca2325c74439a84c2a7eb46033fe213315e9el87cl6dc6a8cb702adffaf Unable to decode output 
address Unspent 0 296 2016-10-21 13:16:09 

https://blockchain.info/tx/18f6ae5323affldca6cf4fc4157fff5a990b37f0e3e43f762e9df5cadce08982 Unable to decode output 
address Unspent 0 296 2016-10-21 13:16:09 

https://blockchain.info/tx/884736546d806654781f4dl45b87e9e947aaf0f76d28e3c4fa399fe2d89a5c43 Unable to decode output 
address Unspent 0 264 2016-10-21 13:16:09 

https://blockchain.info/tx/74f9fcb4eld047278d46cbbba81331abcb2628ea9e250c9a960c002538c664d9 

https://blockchain.info/address/lL8WoLiiGiNvi3TXXW4nMZMwLpKZeV3gKf 

https://blockchain.info/tx-index/185992996 


[hide] 


»7c4f8581ca08c34765 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <6f1 5c1 481 2241 77@chan> 
Date: Thu Dec 8 19:09:37 2016 


NEW CODE: 

https://github.com/WikiLeaksFreedomForce 


[hide] 


»abb82e7b55ebf4abf7 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <fb80b1 481 224532@web.oniichan.onion> 
Date: Thu Dec 8 19:15:32 2016 


>Lets say it is byte 17. If an address is the only one with "00" at byte 17, it might mean "00". If another address has a "00" there, it is 
probably not byte 17. 

>So just have to collect up all the common addresses, see how many there are. 256? 65536? 

>That would be a big clue 


[hide] 


»50ed562f0d2dcd4dcb [Reply] 
Subject: None 
Name: Anonymous 



MessagelD: <4e7641481225855@chan> 
Date: Thu Dec 8 19:37:35 2016 


Download e091 1 .php 
FILE ASSEMBLY CODE: 

http://gateway.glop.me/ipfs/QmVWJVbis7es6s7cDsRmt5WBHeioc4HztR4R74Lg8KBmhU/e091 1. php 


[hide] 


»203efa84a68ee02509 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <a00ac1481226507@chan> 
Date: Thu Dec 8 19:48:27 2016 


Download 435205block.zip 

http://gateway.glop.me/ipfs/QmQniYcDmRMoNCSkaNiwLaBZMFFT3yX8GmF25S9TdJfpRT/435205block.zip 


[hide] 


»57f4b476ad01f7cb9d [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <d55991 481 227341 @chan> 
Date: Thu Dec 8 20:02:21 2016 


https://blockchain.info/address/135zDqhbNcmPk3gbyeJmH75yiLdVZechsK?offset=13350&filter=4 


[hide] 


»196f4464b5351f00f3 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <629d91481227824@chan> 
Date: Thu Dec 8 20:10:24 2016 


https://blockchain.info/address/lE14k7ilwVSytoMfbaCnbmhofVMNsZrpLh 


[hide] 


»1 ad703db1 bf50ae886 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <81 ddOl 481 228271 @chan> 
Date: Thu Dec 8 20:17:51 2016 


Download new. png 

https://blockchain.info/tx/624075b5d5d56b6 1 9b41 3966297b44 1 ae727fc0 1987 1 c22676405dd5d8200cc9 


View information about a bitcoin transaction 624075b5d5d56b619b413966297b441ae727fc019871c22676405dd5d8200cc9 

>OMG 

>1 thnk I found it 
>hang on 
>look at this 

https://blockchain.info/block/0000000000000000026fb408f6a035e55cl26al409e9c5f5fea7d22610645289 
transactions contained within bitcoin block 435172 
>scroll down to roughly 

>It's possible that a 7z or other compressed text document with instructions is hidden within a single transaction 
>And that transaction is spent. 

>37 7a be af 27 lc 20 04 Oe 15 c8 Of 26 20 20 20 20 20 20 20 62 20 20 20 20 20 20 20 50 c7 af >be 01 20 21 67 73 63 6c 69 6c 69 70 
74 72 68 6e 65 74 65 65 74 73 67 68 69 6e 61 65 75 6f 64 >69 6e 65 72 72 69 69 20 01 04 06 20 01 09 26 20 07 0b 01 20 01 21 2 1 01 
20 0c 22 20 08 Od 0a >01 86 66 4f f7 20 20 05 01 19 0c 20 20 20 20 20 20 20 20 20 20 20 20 1 1 17 20 77 20 6c 20 63 >20 6f 20 64 20 
65 20 2e 20 74 20 78 20 74 20 20 20 19 04 20 20 20 20 14 Od 0a 01 20 bd 31 89 >c3 e9 42 d2 01 15 06 01 20 20 20 20 20 

>That's a possible 7z encrypted message, albeit a small one 

https://blockchain.info/address/lE14k7ilwVSvtoMfbaCnbmhofVMNsZrpLh 

Transactions sent and received from bitcoin address lE14k7ilwVSytoMfbaCnbmhofVMNsZrpLh. 

https://blockchain.info/tx/4aadbaa0edd0f0bl9d5e8ae0a818e3ac7fde7cd5f6caedcd9cf4e7ac2b9582e9 

View information about a bitcoin transaction 4aadbaa0edd0f0bl9d5e8ae0a818e3ac7fde7cd5f6caedcd9cf4e7ac2b9582e9 


[hide] 


»f95752327502dbeb0d [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <227331 481 229533@chan> 
Date: Thu Dec 8 20:38:53 2016 


lGiilVoJksAKrL34Gd4sLFlbUTQdUqlqel and i dont know if this is old news but this should be JA's address.. There's a DMS at the 
beginning of the txs 

First being oldest. lFpdrx7Q7fVgfl9imhXeDwNEhBAQVla6Gp 

for example this is one of the 4 txs.. its cryptic so "im dead when back" and likely implies something to do with the hex 

If you look at the oldest tx on Gii, you'll see what looks like a dms.. Y is for key. It's always been here but it needs to be disarmed. 
Thats basically what it is. 

The account basically returns what is sent to it., which is what this 'QdUqlqel' 

The unconfirmed tx has actually been there since this weekend since I found it but it looks like it rejected it and has one from 12/6 
http://gatewav.glop.me/ipfs/QmXUMi6fRG9mNHLTgvthvgDJxUodGCnWFkBfcOfaqZo896/outtx.xlsx 

list of unable to decode from block 43525 1 
43525 Lxlsx 

list of unable to decode from block 435252 
435252. xlsx 

http://gatewav.glop.me/ipfs/QmTtdJr3sEYeWSHdgWTvP7uq89YRQWvUKbyWYcbeBKY6kh/435251.xlsx 

http://gatewav.glop.me/ipfs/QmUslxK7wf89gf9t4wtdRNPpVdaQgnsmLDBcuBrbFcOT5v/435252.xlsx 

http://gateway.glop.me/ipfs/OmUttF4q2JgizGgKkuJoXvWvUaVZvG47XKAguHDYRXlNXP/block 435250 unable to decode. xlsx 
There's only one that had any actual value associated (it's on the list ending in 51) all other transactions have shown as 0 
an example would be if you find a hex code for a 7zip header 

such as in https://blockchain.info/tx/5c593b7b71063a01f4128c98e36fb407b00a87454e67b39ad5f8820ebclb2ad5 
View information about a bitcoin transaction 5c593b7b71063a01f4128c98e36fb407b00a87454e67b39ad5f8820ebclb2ad5 
at bottom 377ABCAF271C 



that is the hex code for a 7zip header 

also i believe this has footer http://www.7-zip.org/recover.html 

just to make sure im not wasting my time, is it a waste of time to be looking at 

https://blockchain.info/address/135zDqhbNcmP k3gbveJmH75yiLdVZechsK?offset=10800&filter=4 , batches of transactions ~20 
each(sometimes significantly more such as the 57 on the 21) at same time, literally thousands of transactions in a row with same file 
size 

throuugh 300 some odd pages, other than the first few, there are only 3 file sizes 
and average bitcoin transaction is -.001 over 84444 transactions 

this one is huge... 

https://blockchain.info/tx/842al7b3a797ec03c7ab856a6e62103c3288e03d790c8dc00a6e9175dl64ece0 

https://blockchain.info/address/135zDqhbNcmPk3gbveJmH75yiLdVZechsK?offset=15250&filter=4 
Transactions sent and received from bitcoin address 135zDqhbNcmPk3gbyeJmH75yiLdVZechsK. 
same size transactions but changes size on oct 9 
fucktons of transactions for weeks all of which are same size 

https://blockchain.info/ip-address/47.89.39.165 , a lot of same size same time transactions and unable to decode output 

http://gatewav.glop.me/ipfs/Omaut7iGTaCoVZE4RAuV6cNBY5B2HxYgZDpaFrpKYKqYgH/Filenames 16D.txt 
http://gatewav.glop.me/ipfs/OmUUWrmeCQrhVOrbVBJqKKBbEWoHEpgWPoKhKi6Yune52Q/Filenames 16G.txt 


[hide] 


»d671 be43059c9344b9 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <c3f361 481 230563@chan> 
Date: Thu Dec 8 20:56:03 2016 


7b03d286ecb4 1 0884a5e07e41b6a7be 1 509afa99e4e001 003f7 lbb3 1 9dfe84dd 
e0f3a7f25bfb9415al 16f26d7f718782157c3772f0e67acc00af2b8aa4309fb7 
603c 128766c75160b533f4f6cfbfl568c9ae7cb238a20791da7437c60afd8 14b 
20aaf28f5030dcb5bcfe9dld2ed632d213671ebef78587e3a629c7a3bdf0d93b 
a2feacf 1 a3e2d 1 e2852326b26e67a22cb784a7c0d6f 1 d992 1 3ee 1 2b389 1 882 1 8 
6e2bead2e61fd87f23e75ad29389f4e58db92b7a96c04e81f5133f29e50f52ac 
d515d0eae9ea00fel6b9335ab946339d6eeef00c7f77c44c2ef41fab738f4401 
da43c8belc81ef20c93014341f7dcb744fff0388fcf6d214a84be4895fa2270b 
this wallet 

https://blockchain.info/address/lAfdbCzDrRrMEq AXkF8kxVRCkPzB8HxoHD?offset=400&filter=l 
wtf? 

must be either a wallet no one cares about or a bug like the wallet with the ripemd hash 00000000000000000000000 


[hide] 


»ae79f491dd8bc72bec [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <bcbdd1 481 231 455@chan> 
Date: Thu Dec 8 21 :1 0:55 201 6 


»f957523275 



https://blockchain.info/address/lGiilVoJksAKrL34Gd4sLFlbUTQdUqlqel 


[hide] 


»8b2068f899ad6c97cd [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <f065c1 481 233292@chan> 
Date: Thu Dec 8 21 :41 :32 201 6 


Possible tip: 

https://blockchain.info/tx/7fle4e76084ab2a44b484358900d74261e4629879dbl73b85251cb54cac21070 

https://blockchain.info/address/lNAQExkFZTFJKQq76KoyUosoQEfiY8K9GN 

https://blockchain.info/address/lB896LaaMVJvQD84ko52XN3976gaKA7nXJ 

Multiple 'Escrows'. Seems like addresses are using the change as in cablegate.7z. 

From: 

7141f6c62892c4c3b85aa989ba54b27be274f5200a715439a75d44b3331da30f 

1883ec71f568cb0644606d2fbfd57e9b01d008503f90b6d934b56d548c08f33d 

c9924669d668e2bcc6c64038f6a33c984cff3d8be758852911f8414666034046 

56f5a921d6fe990715fef88b56379ba2716aa80ec02f4310fa47e2e68ae700e4 

eb5403 14f0 1 a8f7930 Ib3b2fdd2f3dbf 1 62f343b38b9 1 3cd860aae2 1 a2a63G4 

f 1 9c5 1 e46adb68e9235637d7b68d59e0bff6bc8cc0 1 03c442 14efcfe9aa 140af 

8e3ble5d7a290d78b0e34fd54c97da3274c3d5al549ffl228bdb63551fblldc6 

5501f5al930640ee9e554a254d8df29al4b5f5fbc97c31aa0232f9a7202976c9 

319ffa215f446d50091d6900c284319d3d95a0c21ff0ec5b77cf0c08ffc22d52 

718c3be4557660259e38e041a04f7703e8ade3803ab79eda3bc700aeeca96628 

bad344983f7bfa0f84f2befae 1 e 1 78c55b90dbecb 1 aadc074643e 1 59e34054f 1 

5fb72ef284c4bfl31ffa57ba957d03e28e4e9e0ce53ceb6a97e84bab3dllfcld 

60d5d25c4c55a032e3842770495d72ff2f4f7c81 Ia522al8e5 Ib49el92 132283 

7bafcd844fc308280828d2685ab506bd88310653fe7cf43d380cb21a333bf9dl 

69ac8f52cdad01aa7f5d97ff8903a536e52d43026dfac98dabblffac9343808b 

42 1 8dacb23d2a9a09843e 1 1 e 1 fOc 1 c467ff0640c38 1 c3022b34309d847c73584 


[hide] 


»c2539c0631 59c651 3a [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <699771 481 234496@chan> 
Date: Thu Dec 8 22:01 :36 201 6 


Download list.txt 

all from 435165-435382 (some are missing because API limits), spent < 33%, avg unspent value < 0.001 btc, at least 4 outputs 
https://codepaste.net/ta5hyb 


[hide] 


»0f9986ea56dfeb6460 [Replvl 
Subject: None 



Name: Anonymous 

MessagelD: <6ad501481236545@web.oniichan.onion> 
Date: Thu Dec 8 22:35:45 2016 


LAAARP 


[hide] 


»af1 4f49622db67551 5 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <782c61481244785@chan> 
Date: Fri Dec 9 00:53:05 2016 


Download txs.txt 

>spent < 51%, avg unspent value < lbtc, at least 2 outputs 


[hide] 


»009f6ad4c1 a48c1 6e9 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <9492d1481245903@web.oniichan.onion> 
Date: Fri Dec 9 01:1 1:43 2016 


»dc4801 198a 

does anyone have a backup, it was just deleted. 


[hide] 


»ba6cb645293c3824ac [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <58f091 481 2521 17@web.oniichan.onion> 
Date: Fri Dec 9 02:55:17 2016 


»0f9986ea56 

You think someone spent thousands of dollars and went through the trouble of putting every single file uploaded to wikileaks into the 
blockchain since 2013 and predicted assange's final statement on Oct 4 and ran the biggest DDoS attacks in history at the right 
moments, flooded the blockchain at the right moments, and deleted files from wikileaks.org, and convinced julian to develop 
rubberhose and to tell people to look into the blockchain, and convinced the wikileaks staff to go missing all at the same time, and 
convinced gavin to die during the ddos attack, and convinced manning to make a statement predicting that this would all happen, and 
convinced the wikileaks twitter to post torrents with no signatures and to pretend they don't know how to use computers and to stop 
using their public key, and convinced wikileaks email provider to pretend they have a gag order and to like tweets that point it out, and 
ecuador to cut off julians internet access, and julian to never release Clintons deleted emails after saying he would, and for wikileaks to 
stop posting before 10 weeks after publicly saying they would, and julian to say he will step down and that a new way of publishing 
information in a way that cannot be censored on his last statement on October 4, and to convince halfchan and fullchan and plebbit and 
twitter and every site to change their mods and policies so that no discussion of this ever takes place, and convince the US to sell 
ICANN, and lobby for the December 1st rule, and make archive.org change at the exact same time Julian loses his internet so that sites 
can be deleted and modified, 

I dont think you could say someone that is able to do all that is role playing more like just playing with the minds of people like you 



[hide] 


»1 Idl 89e7ad61 e6b83b [Replvl 
Subject: None 
Name: smash 

MessagelD: <1 5fe81 481 254143@web.oniichan.onion> 
Date: Fri Dec 9 03:29:03 201 6 


Download pol - WL Insurance Thread (l).html 

attached is a backup of the endchan thread with the most valuable post at the bottom, save copies. 


[hide] 


»726ec69d565a3022ed [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <1a3d21481256826@web.oniichan.onion> 
Date: Fri Dec 9 04:1 3:46 201 6 


»lldl89e7ad 

do you have one that has the 7z footer and the screenshot of the deleted podesta emails? 


[hide] 


»759d941 88a7d8f970a [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <33ab1 1481298043@2hu.tld> 
Date: Fri Dec 9 15:40:43 2016 


Come help in the open at discord. The more people doing this, the less likely it can be stopped. https://discord.gg/3eV4N 
#blockchain 


[hide] 


»abb08f2e7f28491d5c [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <995921 481 298670@2hu.tld> 
Date: Fri Dec 9 15:51:10 2016 


You fools trying to shill. Get fucked. Anyone who is actually doing this know it's real. There are people like group one and Jean that 
are dishonored by this. The real heroes of our cause. Keep fighting. Spread knowledge. Work in the open, post results. Once enough 
ppl are doing this, there is no stopping it. 


[hide] 


»b1ca00e410aa0dcd73 [Replvl 
Subject: None 



Name: Anonymous 

MessagelD: <f0c561 481 298749@2hu.tld> 
Date: Fri Dec 9 15:52:29 2016 


Download blockchain.pnq 


[hide] 


»5b28cba40b79ea20fe [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <ed5e61481298878@2hu.tld> 
Date: Fri Dec 9 15:54:38 2016 


Download Screenshot 201 61 208-223040. png 

This post went missing off endchan. Please reply with results 


[hide] 


»bf46d46a74a9329039 [Reply] 

Subject: Possible dms wallet? 

Name: Anonymous 

MessagelD: <370901 481 3001 25@2hu.tld> 
Date: Fri Dec 9 16:15:25 2016 


Download IMG 20161209 080758.jpg 
1 Gii 1 Vo Jks AKrL34Gd4sLF 1 bUTQdUq 1 qe 1 

Possible dms wallet. Having issues posting it on polak. Could be nothing, could be everything. 


[hide] 


»b51 b098a931 dd3bfe3 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <96e441481300647@web.oniichan.onion> 
Date: Fri Dec 9 16:24:07 2016 


>discord 

GET FUCKED FBI 


[hide] 


»efb16a441f6e58bb8d [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <f5351 1 481 301 527@2hu.tld> 
Date: Fri Dec 9 16:38:47 2016 


If I was fbi, I wouldn't be asking for help. And I would likely trying to direct ppl to Echo chambers full of cp on onions. I'm just a 
normie that has been working this for almost two months. We need to work in the open so our data isn't lost, and we don't waste time 



repeating the same things. Let's all work together to break this system of child fuckers and ass holes trying to destroy our future. 
Infighting is an insult to Jean, group one, and the others that lost so much over this. We need the normies on board, places like discord 
are good locations to train others of how to retrieve the data and keys. We aren't there yet, but we are close. Please come help if 
willing 


[hide] 


»a9d0daaeedfca471 6c [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <face21 481 31 0368@web.oniichan.onion> 
Date: Fri Dec 9 1 9:06:08 201 6 


Download 2ARMS.FLI Down load MANTA. FLIDownload APACHE. FLI Download MSH.FLIDownload 

BUGS.FLI 

sample .FLI videos, this format is commonly used for maps like this 

https://woodshole.er.usgs.gov/operations/modeling/circulation.html they come out of cad software like autodesk 

http://gateway.glop.me/ipfs/QmTUHgamFvoUwesutXosfGprHYMn2vwX6MGp3ryYKDxDiO/2ARMS.FLI 

http://gateway.glop.me/ipfs/QmTvBvE3pVGpnsg2eavYlkmxHfguXDixC5nZfvxz3hWyL4/APACHE.FLI 

http://gateway.glop.me/ipfs/QmV2ihMzqdr3S35YCrukhhAClKnKKQ36UYGSXM7Zs9H9J2/BUGS.FLI 

http://gateway.glop.me/ipfs/OmdxiHSGTZkuvi6gaPmXWDDLCixbqbEiY5ZZbamBRUQ8DT/MANTA.FLI 

http://gateway.glop.me/ipfs/Qmd8oTT3YsYRswxWxAfaGWdZNyxGlpcEAKMe8fCLaNa8JK/MSH.FLI 


[hide] 


»9861 bdd39ec6e4551 d [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <45e1 614813111 53@chan> 
Date: Fri Dec 9 19:19:13 2016 


Download ritsuko.gif 

HOW TO SPLIT AND UPLOAD GIANT FILES: 

1. Take giant file and slip it into pieces with 7zip 

Linux: http://superuser.com/questions/184557/how-to-create-multipart-7zip-file-in-linux 
Example: 

7z -vlOOm a my_zip.7z my_folder/ 

Windows: http://www.linglom.com/it-support/how-to-split-a-large-file-using-7-zip/ 

2. Upload the pieces to mega.nz or filedropper (max 5GB): 
filedropper.com 

mega.nz 

2b (optional). Do it from the command line to save time: 
https://megatools.megous.com/ 

Example: 

https://www. youtube. com/watch?v=LWfFMvsaspQ&feature=youtu.be 

FILES WE NEED UPLOADS FOR: 

1. All insurance files 

2. Blockchain 

3. SQL databases of the blockchain 

4. wikileaks.org 


[hide] 



»5732a962f93c8970b0 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <b769a148131221 9@web.oniichan.onion> 
Date: Fri Dec 9 1 9:36:59 201 6 


jOdumpprivkey <3 lqneokFGwpEkoZRksjymxZAiTEmAim3 Ab> 


[hide] 


»c5d8fbc4d9a83d61 Ob [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <91 65c1 48131 31 59@web.oniichan.onion> 
Date: Fri Dec 9 19:52:39 2016 


If the internet goes down soon: 

https://www.geckoandfly.com/22562/chat-without-intemet-connection-mesh-network/ 

http://www.cnn.com/2014/10/16/tech/mobile/tomorrow-transformed-firechat/ 

http://hyperboria.net/ 


[hide] 


»da8888232e3afa73fb [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <24c361 48131 3472@chan> 
Date: Fri Dec 9 19:57:52 2016 


Download end. png 


[hide] 


»a2344986d69fcfe2f1 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <037701 48131 4531 @chan> 
Date: Fri Dec 9 20:15:31 2016 


Download endend.pnq 


[hide] 


»ed063208bfb0fbe26b [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <8624a1 481 31 5989@2hu.tld> 
Date: Fri Dec 9 20:39:49 2016 



Download Screenshot 201 61 209-1 22639. png 


[hide] 


»08e1 931 bcec8f8e0cf [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <4a4d01481316852@2hu.tld> 
Date: Fri Dec 9 20:54:12 2016 


Guy's, we are getting close. If tor is compromised, the shadows will only work against our ultimate goals. Remaining isolated will 
only allow the work you have done to be hidden. Please post results here. Any group that has made it, please start work on a normie 
proof breakdown so that we can begin to spread that shit. 


[hide] 


»41fc90206eaf47eb4d [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <55ddc1 481 318111 @chan> 
Date: Fri Dec 9 21:15:11 2016 


Download EndChanPOL Thread.zip 
full endchan thread 


[hide] 


»3f03f2a70c91c6da40 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <037541 481318131 @web.oniichan.onion> 
Date: Fri Dec 9 21:15:31 2016 


Download 68679236.jpg 

>Guy's, we are getting close. 


[hide] 


»3d5696481 70add5543 [Reply] 
Subject: None 
Name: Anonymous 

MessagelD: <68fdc1 481 31 81 90@chan> 
Date: Fri Dec 9 21:1 6:30 2016 


»41fc90206e 

https://mega.nz/#!sIJEGapA!BstPxHzd-qO3s63uXsG0Zty7znPT14oJKuWVu56V450 


[hide] 



»4e9be9610de7a35141 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <9fa46148131 9103@web.oniichan.onion> 
Date: Fri Dec 9 21:31:43 2016 


»08e 1931 bee 

>if tor is compromised 

5 years late brah 


[hide] 


»c3d1 8c7d881 58a0a30 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <91 3f1 1481 31 9332@web.oniichan.onion> 
Date: Fri Dec 9 21:35:32 2016 


»efb!6a441f 

>echo chambers full of cp on onions 

you DO know that that is what most people think this place is, right? 


[hide] 


»8bc4247e838bd29ffc [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <498f71481 32091 O@web.oniichan.onion> 
Date: Fri Dec 9 22:01:50 2016 


»3f03f2a70c 

everyone note this shill that uses meme generator and impact font, he spent a lot of time doing this shit at 8ch before, bounce ideas off 
of him and he'll tell you what are the good leads by 'debunking' them. 


[hide] 


»86c065d1 al e6e841 04 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <bc7051481321028@web.oniichan.onion> 
Date: Fri Dec 9 22:03:48 201 6 


»8bc4247e83 
pizzagate is HARD D: 


[hide] 


»99f21840f3552d0055 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <0b781 1481 321 393@chan> 
Date: Fri Dec 9 22:09:53 2016 



»86c065dlal 

no one cares about pizzagate here, stop trying to discredit this with your shitty pizzagate memes. 


[hide] 


»ebfbb23dcd05882f80 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <4f8421481321470@web.oniichan.onion> 
Date: Fri Dec 9 22:11:10 2016 


»99f21840f3 
chew on this appetizer 

>pizzagate is a jewish conspiracy to destroy the family unit by providing the media a narrative to normalize pedo 


[hide] 


»9806cfaecd5183dd68 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <79cce1481321785@web.oniichan.onion> 
Date: Fri Dec 9 22:16:25 2016 


>autism powered tsunami 

that's the new pisswave? YES LET'S RIDE IT NIGGAH. 


[hide] 


»cafeeb290c00fb90e1 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <f1 31 cl 481 321 824@2hu.tld> 
Date: Fri Dec 9 22:17:04 2016 


I'm not worried. We're close. They know it. Cannot stop a tsunami. Especially when it's powered by autists. Please keep posting finds 
and methods ppl. We have become wise to their tools., they are pathetic. And traitors 


[hide] 


»e5e91 4d567b822c8c1 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <995da1481321882@web.oniichan.onion> 
Date: Fri Dec 9 22:1 8:02 2016 


lolz 2hu's clock was waaaaay off 


[hide] 


»550bc7b2bfd043973e [Reply] 
Subject: None 



Name: Anonymous 

MessagelD: <19f091481328262@web.oniichan.onion> 
Date: Sat Dec 10 00:04:22 2016 


https://i. imgur.com/nTYDpPb. png 


[hide] 


»adefcde4037b854d54 [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <1 6bab1 481 3291 59@web.oniichan.onion> 
Date: Sat Dec 10 00:19:19 2016 


»550bc7b2bf 

unless it's cp you should never link to it instead of posting it here 
fucking niggers 


[hide] 


»61 fea0c351 277f8dfc [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <eb7471481329338@web.oniichan.onion> 
Date: Sat Dec 10 00:22:18 2016 


Download niqger.pna 

»adefcde403 

NIGGER 


[hide] 


»f03cada9d17a6636ef [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <3e1 d41 481331 269@web.oniichan.onion> 
Date: Sat Dec 10 00:54:29 2016 


34 34 31 37 36 36 38 36 30 

"It's the epoch time for Jan 1, 1984 1:01" 


[hide] 


»93c1 dbbf5741 5d1 Odf [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <81f0a1481336762@web.oniichan.onion> 
Date: Sat Dec 10 02:26:02 2016 


most are not verified 
headers: 

docDOCFllEOAlBl 1AE1 



xlsDOCF 11 EO A1 B1 1AE1 

ppt DOCF 11 EO A1 B1 1A El 

zip 50 4B 03 04 14 (I think this one is wrong) 

jpg FF D8 FF EO 00 10 4A 46 49 46 00 01 01 

gif 47 49 46 38 39 61 4E 01 53 00 C4 

pdf 25 50 44 46 2D 31 2E (I think this one is wrong too) 

7zip 37 7A BC AF 27 1C (verified at endchan) 

Torrent 64 38 3A 61 6E 6E 6F 75 6E 63 65 
AVI 52 49 46 46 

footers: 

doc 57 6F 72 64 2E 44 6F 63 75 6D 65 6E 74 2E 

xls FE FF FF FF 00 00 00 00 00 00 00 00 57 00 6F 00 72 00 6B 00 62 00 6F 00 6F 00 6B 00 

ppt 50 00 6F 00 77 00 65 00 72 00 50 00 6F 00 69 00 6E 00 74 00 20 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 

zip 50 4B 05 06 00 (probably wrong) 

gif 2 1 00 00 3B 00 

pdf 25 25 45 4F 46 (probably wrong) 

7zip 00 00 00 17 06 (verified with cablegate) 

we are waiting for someone to post the headers and footers for all pgp, gpg files, they can be found by searching for common hex 
blocks in different files of the same type, someone finished this list but has not posted it. hopefully it's up today, we also are trying to 
get a list of all header/footers found in wikileaks.org/file. if you have some please post here, no links to sites with headers, most of 
them are not real we've found. 


[hide] 


»4d6502130ea1 e71 6ed [Replvl 
Subject: None 
Name: Anonymous 

MessagelD: <73e3a1481345479@chan> 
Date: Sat Dec 1 0 04:51 :1 9 201 6 


»93cldbbf57 

I used a batch with GPG on bash for an 8192 key 

Key-Type: RSA 
Key-Length: 8192 
Name-Real: Name 
Name-Email: name@email.com 
Expire-Date: lOy 

Preferences: SHA512 SHA384 SHA256 SHA224 AES256 AES 192 AES TWOFISH CAST5 BZIP2 ZLIB ZIP Uncompressed 
That let me create an 8192 key. 
and Thanks for the input! 


PGP 2048 PUBLIC KEY HEADER 
mQENBFhLe 

PGP 4096 PUBLIC KEY HEADER 
mQINBFhLe 

PGP 2048 KEY PAIR HEADER 

.XK (with this there was suble variety before the string to the left, either >, 1/2, or 3/4 before the ".") for example, these are the strings 
in three test files: 

1: *. * 1 * / 2 .XKz 
2: *.>.XK{ 

3: •. 3 /4.XK 



PGP 4096 KEY PAIR HEADER 

*.>.XKz (this was consistent across 2 test files) 

PGP 4096 PRIVATE(SECRET) KEY HEADER 
•>.XKz 

PGP 2048 PRIVATE KEY HEADER 

similar results to the key pair, three files. 2048 may have something different going on than 4096. 

1: rVi.XK 
2: *.>.XK 
3: v 3 /4.XK 

PGP 4096 PRIVATE KEY HEADER 
•>.XKz 

8192 isn't supported by kleo generation so i'm lookin for a way to do that, if someone else can chip in i’d apprecaite it. 
Hope this helps. 


Yes, outside the BEGIN PUBLIC/PRIVATE KEY part. You don’t need to convert it to hex I can do that but it would help 
doccumenting it like the previous magic numbers posted. 2048, 4096, and 8192 keys are what I want to search for. 


I presume you mean outside of the BEGIN PUBLIC PGP KEY etc. strings right? 


[hide] 


»22f21 977734381 dea7 [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <3c7dd1 481 353657@chan> 
Date: Sat Dec 10 07:07:37 2016 


There news that some groups are starting to find torrent headers in the blockchain. Some advice regarding that. 

1. Check the file structure. 

A torrent file is a bencoded dictionary with the following keys: 
announce — the URL of the tracker 

info — this maps to a dictionary whose keys are dependent on whether one or more files are being shared: 

name — suggested filename where the file is to be saved (if one file)/suggested directory name where the files are to be saved (if 
multiple files) 

piece length — number of bytes per piece. This is commonly 28 KiB = 256 KiB = 262,144 B. 

pieces — a hash list, i.e., a concatenation of each piece's SHA-1 hash. As SHA-1 returns a 160-bit hash, pieces will be a string whose 
length is a multiple of 160-bits. If the torrent contains multiple files, the pieces are formed by concatenating the files in the order 
they appear in the files dictionary (i.e. all pieces in the torrent are the full piece length except for the last piece, which may be 

shorter). 

length — size of the file in bytes (only when one file is being shared) 

files — a list of dictionaries each corresponding to a file (only when multiple files are being shared). Each dictionary has the 
following keys: 

path — a list of strings corresponding to subdirectory names, the last of which is the actual file name 
length — size of the file in bytes. 

2. Check the tracker information. 

Multiple trackers 

BEP-0012[4] extends BitTorrent to support multiple trackers. 

A new key, announce-list, is placed in the top-most dictionary (i.e. with announce and info) 

{ 

'announce-list': [['<trackerl-url>']['<tracker2-url>']] 



} 

3. If it a single file or Multi file torrent 
Single file[edit] 

Here is what a de-bencoded torrent file (with piece length 256 KiB = 262144 bytes) for a file debian-503-amd64-CD-l.iso (whose size 
is 678 301 696 bytes) might look like: 

{ 

'announce': ' http://bttracker.debian.org:6969/announce' ;, 

'info': 

{ 

'name': ’debian-503-amd64-CD-l.iso', 

'piece length’: 262144, 

'length': 678301696, 

'pieces': ’84 1 ae846bc5b6d7bd6e9aa3dd9e55 1 559c82abc 1 . . .d 14f 1 63 1 d776008f 83772ee 1 70c424 116181 90a4' 

} 

} 

{ 

'announce': ' http://tracker.sitel.com/announce' ;, 

'info': 

{ 

’name': 'directoryName', 

'piece length': 262144, 

'files': 

[ 

{'path': ['lll.txt'], 'length': 111}, 

{'path': ['222.txt'], 'length': 222} 

], 

’pieces': '6a8af7eda90ba9f851831073c48ea6b7b7e9feeb...8a43d9d965a47f75488d3fb47d2c586337a20b9f 

} 

} 

4. Trackers 

You can see the tracker in: 

’announce 1 : ' http://bttracker.debian.org:6969/announce' ;, 

5. Check the trackers to see if the files are valid. 

Trackers themselves should be verified by Verisgn or any other tool for tracker verification. 

If the file is downloaded, keep it and post it here. If the torrent was incomplete or corrupted it might be possible to fix it with file 
recovery software. 


[hide] 


»21 7e9fac3c6a5f5352 [Reply} 

Subject: None 
Name: Anonymous 

MessagelD: <ccc271 481 384761 @chan> 
Date: Sat Dec 10 15:46:01 2016 


Download guide. png 
use this 


[hide] 



»e1 75d2ba54095f1 3de [Reply! 

Subject: None 
Name: Anonymous 

MessagelD: <aafc21481385305@chan> 
Date: Sat Dec 10 15:55:05 2016 


»93cldbbf57 
»4d6502130e 
list used on the git code 


if " DOCF 1 1 EO A 1 B 1 1 AE 1 " . lo wer() in hexcode: 

filetype += "DOC Header Found " # DOC Header 

if ”576F72642E446F63756D656E742E".lower() in hexcode: 
filetype += "DOC Footer Found " # DOC Footer 

if " DOCF 1 1 EO A 1 B 1 1 AE 1 " . lo wer() in hexcode: 

filetype += "XLS Header Found " # XLS Header 

if ”FEFFFFFF000000000000000057006F0072006B0062006F006F006B00".lower() in hexcode: 
filetype += "XLS Footer Found " # XLS Footer 

if " DOCF 1 1 EO A 1 B 1 1 AE 1 " . lo wer() in hexcode: 

filetype += "PPT Header Found " # PPT Header 

if "A0461DF0".lower() in hexcode: 

filetype += "PPT Footer Found " # PPT Footer 

if "504B030414".lower() in hexcode: 

filetype += "ZIP Header Found ” # ZIP Header 

if "504B050600".lower() in hexcode: 

filetype += "ZIP Footer Found " # ZIP Footer 

if "504B030414000100630000000000".lower() in hexcode: 
filetype += "ZIPLock Footer Found " # ZLocked Encrypted 

if "FFD8FFE000 1 04A464946000 101" .lo wer() in hexcode: 
filetype += "JPG Header Found ” # JPG Header 

if ”474946383961 ".lowerO in hexcode: 

filetype += "GIF Header Found ” # GIF Header 

if ”474946383761 ”.lower() in hexcode: 

filetype += "GIF Header Found ” # GIF Header 

if ”2100003B00".lower() in hexcode: 

filetype += "GIF Footer Found " # GIF Footer 

if " 25504446". lower() in hexcode: 

filetype += "PDF Header Found " # PDF Header 

if " 2623323035 " ,lower() in hexcode: 

filetype += "PDF Header Found " # PDF Header 

if " 2525454F46" .lo wer() in hexcode: 

filetype += "PDF Footer Found " # PDF Footer 

if "616E6E6F756E6365".lower() in hexcode: 

filetype += "Torrent Header Found " # Torrent Header 

if "lF8B".lower() in hexcode: 

filetype += '.TAR.GZ Header Found " # TAR/GZ Header I Going to have lots of false positives 

if "001 1 AF".lower() in hexcode: 

filetype += "FLI Header Found " # FLI Header 

if "504B03040A000200".lower() in hexcode: 

filetype += "EPUB Header Found " # EPUB Header 

if " 89504E470D0A 1 A0A" .lower() in hexcode: 

filetype += "PNG Header Found " # PNG Header 

if "6D51514E42".lower() in hexcode: 

filetype += "8192PGP Header Found " # 8192 Header 

if "6D51494E4246672F".lower() in hexcode: 

filetype += "4096PGP Header Found " # 4096 Header 

if "952e3e2e584b7a". lower in hexcode: 

filetype += "2048PGP Header Found " # 2048 Header 

if "52617221 lA0700".lower() in hexcode: 

filetype += "Secret Header Found" # Secret Header 
if ”6D51454E424667".lower() in hexcode: 

filetype += "RAR Header Found" # RAR Header 



if "EFEDFACE".lower() in hexcode: 

filetype += "UTF8 Header Found" # UTF8 header 
if "4F676753".lower() in hexcode: 

filetype += "OGG Header Found" # OGG Header 
if "42494646 "do wer() in hexcode and "57415645"dower() in hexcode: 
filetype += "WAV Header Found" # WAV Header 
if "42494646" do wer() in hexcode and "4 1564920" dower() in hexcode: 
filetype += "AVI Header Found" # AVI Header 
if "4D546864"dower() in hexcode: 

filetype += "MIDI Header Found" # MIDI Header 
if " 377ABCAF27 1C" dower() in hexcode: 

filetype += "7z Header Found" # 7z Header 
if " 000000 1 706 " do wer() in hexcode: 

filetype += "7z Footer Found" # 7z Footer 


[hide] 


»9b230ecdadb7e0ce00 [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <90ee81 481 5061 09@web.oniichan.onion> 
Date: Mon Dec 1 2 01 :28:29 201 6 


with hyperlinks to blockchaindnfo for each 


all non-standard transactions from the first 85% of the blockchain 


whats in the big dump? 


[8:16 PM] x: 

https://cdn.discordapp.com/attachments/250364840667906048/257677Q41313251328/patterns.txt 

[8:16 PM] x: this was ran on 85% of the blockchain 

[8:16 PM]x: with this we can easily identify the patterns used to store data 

[8:17 PM] x: and the big dump 

[8:17 PM]x: https://mega.nz/#!soVW3Iia!MeqMJFf4-lUZbDWfdpQp3fqBiVlVs-liMefNXuUHS0g 


https://github.com/WikiFeaksFreedomForce 

https://discordapp.com/invite/4yaZgkD #blockchain (fastposting but twitter levels of compromised) 
https://endchan.xyz/POFAK/res/15.html 

https://2hu-ch.org/thread-5b30554cf29Q73d3aeela74c298234c8e36a7bad.html 

updates from people are not really not coming thru, posts from findings have been ded for a while, groups must be keepign them to 
themselves or the messages are lbocked somehwo. if findings dont start coming thru the next group will probably have to start from 
scratch (for the 4th time now...) we waiting for this also. 

HOW TO SPFIT AND UPFOAD GIANT FIFES: 

1. Take giant file and slip it into pieces with 7zip 

Finux: http://superuser.eom/questions/l 84557/how-to-create-multipart-7zip-file-in-linux&nbsp ; 

Example: 

7z -vlOOm a my_zip.7z my_folder/ 

Windows: http://www.linglom.com/it-support/how-to-split-a-large-file-using-7-zip/ 

2. Upload the pieces to mega.nz or filedropper (max 5GB): 
filedropper.com 

mega.nz 

2b (optional). Do it from the command line to save time: 



https://megatools.megous.com/ 

Example: 

https://www. youtube. com/watch?v=LWfFMysaspQ&feature=voutu.be 

FILES WE NEED UPLOADS FOR: 

1. All insurance files 

2. Blockchain 

3. SQL databases of the blockchain 

4. wikileaks.org 


Where's everyone at with this? 


[hide] 


»54f3e542de33b7b03d [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <7ef001 481 506637@web.oniichan.onion> 
Date: Mon Dec 1 2 01 :37:1 7 201 6 


»9b230ecdad 

the most recent revisions can be found at https://github.com/manly/BlockChainParser which is cited in the WLFF repo 


[hide] 


»7041 dl 99d3350b5bbf [Reply] 

Subject: None 
Name: Anonymous 

MessagelD: <5a9961481509394@chan> 
Date: Mon Dec 1 2 02:23:1 4 201 6 


Intel dump: 

https://zerobinqmdqd236y. onion. to/?7cd87b53cal99bdb#+Ht0Kg+aa8Nqx4oKXQIPM9UZibcVuZMMBMw221c/+pw= 


[hide] 


»61 6801 6d6d48f9af5f [Reply] 

Subject: None 

Name: Anonymous 

MessagelD: <1 8fcf1 481 51 1 1 33@chan> 

Date: Mon Dec 1 2 02:52:1 3 201 6 


Download Enter the Void - Intro Title Credit Sequence f1080p).mp4 


[hide] 



